API Keys and Rate Limits

Auth & limits

Part of: Your First API Call

In 2023 a developer pasted his cloud API key into a public GitHub repo for "just five minutes" while testing. Automated scanners found it in under a minute and ran up a five-figure bill before he noticed. The lesson is brutal and simple: an API key is a password, and the internet never stops scanning for leaked ones. What it is An API key tells Anthropic who's calling, so they can check you're allowed and bill the right account . A Claude key is a long string like sk-ant-..., generated in the Anthropic console. Every request includes it, and the server verifies it before doing any work. No valid key, no answer. You get a 401 Unauthorized. Treat it exactly like a credit card number. Anyone holding your key can spend your money. How it works The rule that saves careers: never paste your key into your script. If it ends up in code you push to GitHub, bots will find it and drain your account. Instead, store the key in an environment variable , a value that lives in your computer's environment, outside your source code. You set it once in your terminal: Then your script reads it at runtime, and the secret never appears in the file: Now you can share the code freely; the key stays on you

Challenge: The Rate Limiter