2.c: API Keys and Authentication

Secure authentication is fundamental for using AI coding tools. This section covers obtaining and managing API keys for Anthropic (Claude Code) and OpenAI (Codex CLI), as well as best practices that apply across all providers.

Obtaining API Keys

Anthropic (for Claude Code)

1. Visit console.anthropic.com
2. Create an account or sign in
3. Navigate to "API Keys" in your account settings
4. Click "Create Key" and give it a descriptive name (e.g., "claude-code-laptop")
5. Copy the key immediately — it will not be shown again

OpenAI (for Codex CLI)

1. Visit platform.openai.com
2. Create an account or sign in
3. Navigate to "API keys" in your account settings
4. Click "Create new secret key"
5. Copy the key immediately — it will not be shown again

Other Providers

For tools that support multiple providers (like Codex CLI with its --provider flag or Continue.dev):

• Azure OpenAI: portal.azure.com — Azure OpenAI Service resource
• Google (Gemini): ai.google.dev — API key from Google AI Studio
• Ollama (local): No API key needed — models run locally

Secure Handling of API Keys

API keys are confidential credentials. Treat them with the same care as passwords.

Essential Practices

• Never share publicly: Do not commit keys to Git, paste them in public forums, or include them in client-side code.

• Use environment variables: The standard and recommended practice. This keeps keys out of your codebase entirely.

  # In your shell config (~/.bashrc, ~/.zshrc, or ~/.config/fish/config.fish)
  export ANTHROPIC_API_KEY="sk-ant-..."
  export OPENAI_API_KEY="sk-..."
  

• Use .env files locally (with .gitignore): For project-specific keys, create a .env file and ensure it is listed in .gitignore.

  # .env (never commit this file)
  ANTHROPIC_API_KEY=sk-ant-...
  OPENAI_API_KEY=sk-...
  

  # .gitignore
  .env
  .env.local
  .env.*.local
  

• Use secret managers in production: For CI/CD and deployed applications, use your platform's secret management:

  • GitHub Actions: Repository secrets
  • AWS: Secrets Manager
  • Google Cloud: Secret Manager
  • Azure: Key Vault

• Rotate keys regularly: Generate new keys periodically, especially if you suspect compromise. Revoke old keys immediately.

• Use project-scoped keys where possible: Both Anthropic and OpenAI support project-level key scoping, which limits what each key can access.

Authentication for Claude Code

Claude Code handles authentication automatically once your API key is set:

# Method 1: Environment variable (recommended)
export ANTHROPIC_API_KEY="sk-ant-..."

# Method 2: Claude Code will prompt you to authenticate
# on first run if no key is found — it opens a browser
# for OAuth-style authentication

# Method 3: For CI/CD or non-interactive use
ANTHROPIC_API_KEY="sk-ant-..." claude -p "Run the test suite"

Checking Authentication

# Claude Code shows your authentication status at startup
claude
# Look for: "Authenticated as: your-email@example.com"

Authentication for Codex CLI

# Method 1: Environment variable (recommended)
export OPENAI_API_KEY="sk-..."

# Method 2: .env file in project root
echo 'OPENAI_API_KEY=sk-...' > .env

# Method 3: Using a different provider
export ANTHROPIC_API_KEY="sk-ant-..."
codex --provider anthropic "Your task here"

Organisation and Project IDs

OpenAI

For users belonging to multiple organisations on the OpenAI platform:

• Organisation IDs: Found in your organisation settings on platform.openai.com
• Project IDs: Found in the project settings page

When making direct API calls, include these headers:

OpenAI-Organization: YOUR_ORG_ID
OpenAI-Project: YOUR_PROJECT_ID

The Codex CLI may handle this automatically based on your default settings.

Anthropic

Anthropic's console supports Workspaces for team organisation. API keys are scoped to a workspace, providing natural access control.

Cost Management

Both providers charge based on token usage. Monitor your spending:

Anthropic

• Check usage at console.anthropic.com under "Usage"
• Set spending limits and alerts
• Claude Code shows per-session costs via the /cost command

OpenAI

• Check usage at platform.openai.com/usage
• Set monthly spending limits
• Configure per-key usage limits

Practical Tips

• Start with conservative spending limits and increase as needed
• Use faster/cheaper models (Sonnet 4.6, o4-mini) for routine tasks
• Reserve expensive models (Opus 4.8, o3) for complex reasoning
• Monitor cost per task to optimise your model selection

Summary: Authentication Quick Reference

Tool	Environment Variable	Where to Get Key
Claude Code	ANTHROPIC_API_KEY	console.anthropic.com
Codex CLI (OpenAI)	OPENAI_API_KEY	platform.openai.com
Codex CLI (Anthropic)	ANTHROPIC_API_KEY	console.anthropic.com
Cursor	Built-in auth	cursor.sh (account settings)
GitHub Copilot	GitHub OAuth	github.com (Copilot settings)
Continue.dev	Per-provider	Depends on configured provider

---

Next: Chapter 3: Mastering AI Coding Agents