Anthropic API keys now belong to people, not workspaces

Most small teams have the same AI credential story: one workspace API key, pasted into four places, created by someone who may or may not still work there. Anthropic just made that arrangement the legacy option. As of August 27, the Claude Console issues personal keys and service account keys — and a personal key dies when its owner leaves the org.

What actually happened

Per the Claude Platform release notes, you can now create two new kinds of API key in the Console. A personal key acts as you, with your permissions. A service account key acts as a service account, with that account's permissions. Both stop working when the linked account is removed from the organization. Either kind can be scoped to a single workspace, or granted access to admin endpoints and every workspace the account can reach.

Workspace API keys — the ones tied to a container instead of an identity — "remain supported as a legacy option." That is the polite version of a deprecation notice.

The same week, Anthropic shipped a related SDK change: client.beta.files and client.beta.skills stopped sending the files-api-2025-04-14 and skills-2025-10-02 beta headers and now return the same shapes as their non-beta counterparts. Two behavior changes ride along — client.beta.skills.delete() now removes a Skill and all of its versions, and the Messages type BetaSkill is renamed BetaContainerSkill. Requests still sending the beta headers keep the old shapes, so nothing breaks today. It breaks the day someone bumps the SDK without reading the note.

Why it matters for your business

Identity-bound keys fix the single worst credential failure mode in a small shop: the orphan key. A workspace key has no owner, so nobody rotates it, nobody can say what it's for, and offboarding a contractor does nothing to it. A personal key has a name attached and revokes itself on departure. That is a real control, for free, in the Console.

The trade is that you now have to think about which identity should own each integration. Rule of thumb: anything a human runs from a laptop gets a personal key. Anything running unattended — a cron job, your ops automation, a support bot, a deploy step — gets a service account key, not a person's. If your invoicing agent stops working because the developer who built it changed jobs, you scoped it wrong.

Then do the boring pass: inventory every place a Claude key is pasted, map each to an identity, scope it to one workspace, and pair it with an expiration so rotation is scheduled rather than aspirational. And treat a version bump as a change: skills.delete() now takes every version with it, which is a very different outcome than what that call did last month.

Sources: Claude Platform release notes, Anthropic API keys documentation.