Service Accounts

For non-interactive callers — CI pipelines, scheduled jobs, Claude Desktop — use an API key instead of the OAuth helper.

Create a key

In the console, open the Keys tab and create a key. The raw value is shown once in a copy-once modal and is never retrievable again — copy it immediately.

Keys are prefixed so they are grep-able if leaked:


ar_live_<base62_random_32chars>    # production proxy
ar_test_<base62_random_32chars>    # dev proxy

Use the key

Pass the raw key as the x-api-key header (or as Claude’s ANTHROPIC_API_KEY). The proxy extracts the 8-character prefix, looks up the key record in DynamoDB, and verifies the full value with a bcrypt comparison against the stored hash.


ANTHROPIC_BASE_URL=https://<slug>.proxy.<domain>/anthropic/v1
ANTHROPIC_API_KEY=ar_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

A key carries scopes (proxy:invoke in the MVP) and may set its own allowed_models, allowed_regions, monthly_budget_usd, and expires_at. If a key omits model/region limits, it inherits them from the associated user’s grant.

Rotation and revocation

Rotate: create a new key, update the caller’s config, then revoke the old key. Both work during the transition window.
Revoke: takes effect on the next request — the DynamoDB lookup returns status=revoked and the proxy responds 401.

See API Keys for the full field set and lifecycle.