Claude Code "API key not configured" and authentication errors: 5 causes in diagnostic order

Claude Code CLI authentication fails in several distinct ways — the error messages are similar but the fixes are different. This page covers all five causes in the order you should check them, from most common to least common.

The 30-second fix

What the error actually looks like — and what we verified on 5 September 2026

Two things on this page were checked against the real CLI (@anthropic-ai/claude-code 2.1.261, installed fresh with npm on Linux, Node 22) rather than recalled from memory. Both changed what this page used to say.

1. claude login is not a command. In 2.1.x the word login after claude is treated as your first prompt, so you get a chat answer instead of a login flow:

$ claude login
It looks like your message just says "login" — I don't have a login flow or
authentication system to walk you through by default. Could you clarify what
you're trying to do? ...

The authentication commands are under claude auth, plus /login inside a running session and claude setup-token for a long-lived token:

$ claude auth --help
Commands:
  login [options]   Sign in to your Anthropic account
  logout            Log out from your Anthropic account
  status [options]  Show authentication status

$ claude auth login --help
Options:
  --claudeai       Use Claude subscription (default)
  --console        Use Anthropic Console (API usage billing) instead of Claude subscription
  --email <email>  Pre-populate email address on the login page
  --sso            Force SSO login flow

Note the --claudeai / --console split: the default signs you in with a Claude subscription (Pro/Max), while --console bills API usage to an Anthropic Console account. Picking the wrong one is a common reason a "working" login still produces 401s or unexpected billing.

2. The messages people are actually searching for. Search Console query data for this page (September 2026) shows the real strings users paste into Google; none of them say "API key not configured". They are:

⏺ Please run /login · API Error: 401 Invalid authentication credentials

API Error: UnauthorizedException: session token not found or invalid

API Error: 401 {"type":"error","error":{"type":"authentication_error","message":"invalid x-api-key"}}

The first two come from the interactive session when the stored OAuth token is missing, expired or revoked; the third is the raw API response when an ANTHROPIC_API_KEY is present but wrong. If you see "Please run /login", do exactly that inside the session (or claude auth login from the shell). If you see invalid x-api-key, the problem is the key in your environment, not your login.

3. The fastest way to see which auth path is active is claude auth status, which prints JSON — for a subscription login it reports "authMethod": "oauth_token" and "apiProvider": "firstParty":

$ claude auth status
{
  "loggedIn": true,
  "authMethod": "oauth_token",
  "apiProvider": "firstParty",
  ...
}

If ANTHROPIC_API_KEY is exported, that key takes precedence over the subscription login for API calls — which is exactly how a paid Max subscriber ends up being billed through the Console, or gets 401s from a revoked key while "logged in". Unset the variable (unset ANTHROPIC_API_KEY) and re-check claude auth status.

Not re-verified on this date: the exact on-disk location of the OAuth credential (on macOS it is held in the login Keychain — Claude Code's own --help refers to "keychain reads" — rather than a plain file), and the exact text of the unauthenticated error in a completely fresh install, which could not be reproduced in the test environment. Steps below that mention a credentials file are kept as a fallback for Linux, not a first step.

Cause 1: ANTHROPIC_API_KEY not exported in the current shell

This is the most common cause when running Claude Code without having used claude auth login. Environment variables set in one terminal tab are not automatically available in another. If you set the variable in ~/.bashrc or ~/.zshrc but haven't sourced the file in the current session, the variable won't be present.

How to check:

echo $ANTHROPIC_API_KEY

If this prints nothing, the variable is not set in your current shell session.

Fix options:

# Option 1: export for the current session only
export ANTHROPIC_API_KEY=sk-ant-api03-...

# Option 2: add to shell profile so it persists across sessions
echo 'export ANTHROPIC_API_KEY=sk-ant-api03-...' >> ~/.zshrc
source ~/.zshrc

# Option 3: pass it inline for a single command
ANTHROPIC_API_KEY=sk-ant-api03-... claude "your prompt here"

Cause 2: OAuth token from claude auth login has expired or been revoked

If you authenticated via claude auth login (the browser-based OAuth flow), Claude Code stores a token locally — in the login Keychain on macOS, in a file under ~/.claude/ on Linux. This token can expire, be revoked if you changed your claude.ai password, or become invalid if your subscription status changed.

How to check:

claude auth status        # "loggedIn": false, or a stale authMethod, means re-authenticate

Fix: re-run the login flow to get a fresh token:

claude auth login          # or /login inside a running session

This opens a browser window to claude.ai to re-authorize. If the browser flow completes successfully, Claude Code will write a new valid token to the credentials file.

If the login flow itself fails, log out first to clear any corrupt state, then sign in again:

claude auth logout
claude auth login

Cause 3: API key has been revoked or regenerated in the Anthropic console

If you're using an API key directly (not OAuth), the key may have been revoked through the Anthropic console — either by you, another team member, or automatically if the account was flagged. A revoked key returns an invalid_api_key error even though it was valid when you set it.

How to check: log in to console.anthropic.com/settings/keys. If the key you're using is not listed or shows as "Revoked", that's the issue.

Fix: generate a new key from the console and update your environment variable or secrets manager. If you're using the key in multiple places (CI/CD, local dev, team shared config), update all locations.

Cause 4: Key set in wrong config scope (project vs. global)

Claude Code supports configuration at multiple scopes: global (~/.claude/settings.json or env vars), project-level (.claude/settings.json in the project directory), and inline. If a project-level configuration specifies an API endpoint or auth settings that override your global config, your global key may be ignored.

How to check:

# Check for a project-level claude config
cat .claude/settings.json 2>/dev/null || echo "No project-level config"

# Check the global config
cat ~/.claude/settings.json 2>/dev/null

Look for any apiKey, apiBaseUrl, or auth-related settings that might be overriding the default.

Fix: if a project-level config is setting a different API endpoint or key, either update it to use the correct key, remove the override, or explicitly set ANTHROPIC_API_KEY in the environment — environment variables take precedence over config file values in most cases.

Cause 5: Enterprise/proxy configuration — custom API endpoint

Some organizations route Anthropic API traffic through an internal proxy or use a cloud provider's managed Anthropic endpoint (AWS Bedrock, Google Cloud Vertex AI). Claude Code supports custom endpoints via the ANTHROPIC_BASE_URL environment variable or the apiBaseUrl config setting.

If your organization uses one of these setups, authentication works differently:

How to check: ask your IT or platform team what endpoint Claude Code should be using. If ANTHROPIC_BASE_URL is set to something other than https://api.anthropic.com, you're in this case.

Fix: configure the credentials for the specific endpoint you're using. For Bedrock and Vertex, follow Anthropic's documentation on using Claude Code with cloud provider endpoints — the auth setup is entirely different from the standard API key flow.

Quick diagnostic checklist

  1. Run echo $ANTHROPIC_API_KEY — does it print your key? If not → Cause 1.
  2. Run claude --version — does it respond? If it hangs or errors → try re-login.
  3. Run claude auth login — does the browser auth complete successfully? If not → check your claude.ai subscription status.
  4. Log in to console.anthropic.com/settings/keys — is the key you're using listed and active? If not → Cause 3.
  5. Check for .claude/settings.json in your project directory → Cause 4.
  6. Check echo $ANTHROPIC_BASE_URL — is it set to a non-default URL? → Cause 5.

Setting up Claude Code from scratch (clean install)

# Install Claude Code
npm install -g @anthropic-ai/claude-code

# Method A: Browser login with a Claude subscription (Pro/Max)
claude auth login            # add --console to bill API usage to an Anthropic Console account instead
# Follow browser prompt, authorize in claude.ai

# Method B: Direct API key (required for CI/CD and team setups)
export ANTHROPIC_API_KEY=sk-ant-api03-...
# Optionally add to shell profile for persistence

# Verify authentication
claude --version  # should print version
echo "test" | claude  # basic sanity check

Related

Verified on 5 September 2026 against @anthropic-ai/claude-code 2.1.261 (fresh npm install, Node 22, Linux): auth subcommands, the non-existence of claude login, claude auth status output and the --claudeai/--console split were run and transcribed; the error strings shown are the ones users search for per Search Console. The unauthenticated fresh-install message and the macOS credential location were not reproduced on this date.

Related fixes