# Claude Code using your API key, not your plan? Fix it > Claude Code uses an API key instead of your subscription when one is set, because it outranks your Pro or Max login. Find it with /status and remove it. Source: https://shuriken.sh/guides/claude-code-using-api-key-instead-of-subscription Claude Code bills an API key instead of your plan when one is exported in your shell, set in a settings file or returned by a key helper script, because each ranks above the subscription you signed in with /login. Run /status, unset the key, remove it from your shell profile and settings, then relaunch. By Shuriken Updated 27 October 2026 6 min read **Contents** Claude Code is using an API key instead of your subscription because a credential that outranks your /login is set: ANTHROPIC_API_KEY in your environment, ANTHROPIC_AUTH_TOKEN, or an apiKeyHelper script in a settings file. Each session uses one credential, and your Pro or Max login is last of the seven it checks. Run /status, remove the key from every place it is set, and start a new session. With ANTHROPIC_API_KEY set, the help centre says, "Claude Code will use this API key for authentication instead of your Claude subscription (Pro, Max, Team, or Enterprise plans), resulting in API usage charges rather than using your subscription's included usage" ([Claude Help Center](https://support.claude.com/en/articles/11145838-use-claude-code-with-your-pro-or-max-plan)). A session on a key looks the same as one on your plan, so you may first notice it as a Console charge or as one of the errors below. ## Why Claude Code uses an API key instead of your subscription # Anthropic's [authentication docs](https://code.claude.com/docs/en/authentication#authentication-precedence) list the order Claude Code checks, as of 24 October 2026. The first one it finds wins: - Cloud provider credentials, when CLAUDE_CODE_USE_BEDROCK, CLAUDE_CODE_USE_VERTEX or CLAUDE_CODE_USE_FOUNDRY is set. - ANTHROPIC_AUTH_TOKEN, a bearer token for an LLM gateway or proxy. - ANTHROPIC_API_KEY. In an interactive session you're asked once whether to use it, and Claude Code remembers your answer. With -p it is always used. - The output of an apiKeyHelper script set in a settings file. - CLAUDE_CODE_OAUTH_TOKEN, the long-lived token claude setup-token prints. - Anthropic profile and federation credentials, the ones the ant CLI and Workload Identity Federation use. A profile that ant auth login wrote ranks here only when ANTHROPIC_PROFILE names it. - Your subscription login from /login. That remembered answer is the trap. Approve an exported key once and every later interactive session uses it, until you change the answer in /config or remove the key. ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN and apiKeyHelper also apply to the VS Code extension, the Agent SDK and GitHub Actions, because they wrap the CLI. Claude Desktop and cloud sessions don't read them, so the desktop app can be on your plan while the terminal next to it is on a key. ## How to check which one Claude Code is using # /status inside Claude Code shows the account and login method. With a login and an API key both configured, it marks the one that isn't in use. From a shell, claude auth status prints JSON, and its authMethod field reads: - claude.ai for your subscription - api_key or api_key_helper for a key - oauth_token for a CLAUDE_CODE_OAUTH_TOKEN To see the variables themselves, in the same terminal you start claude from: bash env | grep -E 'ANTHROPIC|CLAUDE_CODE_OAUTH|CLAUDE_CODE_USE_' In PowerShell, Get-ChildItem Env:ANTHROPIC*. Anthropic's error reference adds that direnv, dotenv shell plugins and IDE terminals can load a stale key from a project's .env file without you setting it, so check inside the project folder too. ## Fix it: stop Claude Code using the API key # - Unset the key in the current shell: unset ANTHROPIC_API_KEY on macOS and Linux, Remove-Item Env:ANTHROPIC_API_KEY in PowerShell, set ANTHROPIC_API_KEY= in CMD. Do the same for ANTHROPIC_AUTH_TOKEN if it showed up. - Delete the line that sets it: grep -n ANTHROPIC ~/.zshrc ~/.zprofile ~/.bashrc ~/.bash_profile ~/.profile finds it. On Windows, delete it under System Properties › Environment Variables. - Check the env block and any apiKeyHelper in ~/.claude/settings.json, .claude/settings.json and .claude/settings.local.json. The [settings reference](https://code.claude.com/docs/en/settings-reference) says a value in env overwrites the same variable exported in your shell, so unsetting it in the terminal changes nothing while it's still there. - Open a new terminal and start claude. Run /login if you've never signed in with your subscription on this machine. Running /login while the key is still set changes nothing, because the key outranks it. - Run /status again and confirm the login method is your Claude account. To keep the key exported for other tools, switch Use custom API key off in /config, which changes the answer you gave the first time. The toggle only appears while ANTHROPIC_API_KEY is set, and claude -p ignores it: print mode uses the key whenever it's present. On macOS and Linux, env -u ANTHROPIC_API_KEY claude starts one session without the key. ## The CLAUDE_CODE_OAUTH_TOKEN trap # A token from claude setup-token runs on a subscription, so it doesn't bill the API. It can still put you on the wrong subscription. Per the docs, /login while CLAUDE_CODE_OAUTH_TOKEN is set switches the current session to the new login, but every new session reads the variable again until you delete it from your shell profile or a settings env block. /login looks like it worked, and the next claude is back on the token's account. Repeated sign-in prompts have their own causes, listed in [Claude Code keeps asking you to log in](https://shuriken.sh/guides/claude-code-keeps-asking-to-log-in). Shuriken shows what every plan you hold has left in one figure, and what each turn costs as it runs. [Download](https://shuriken.sh/download) ## Errors that mean a key has taken over # | Message | What Anthropic's [error reference](https://code.claude.com/docs/en/errors) says | Fix | | --- | --- | --- | | Credit balance is too low | The key's Console organisation has no prepaid credits, or a Console key is in use when you meant your subscription | Remove the key (steps above), or add credits if you meant to pay by key | | Your ANTHROPIC_API_KEY belongs to a disabled organization | A stale key from a disabled Console organisation overrides your saved login | Unset it and remove it from your shell profile | | API Error: 400 ... This organization has been disabled. | The same stale key, as the API words it | The same | | Your organization has disabled API key authentication | Your Console organisation's admin turned off API key authentication, and an env key or apiKeyHelper still supplies one | Remove the key or the apiKeyHelper setting, then /login | The credit balance case, including why claude -p fails while interactive sessions work, is covered step by step in [Credit balance is too low on a paid plan](https://shuriken.sh/guides/claude-code-credit-balance-too-low). ## If the key has already been billed # Anthropic points billing questions to the [Usage page in the Claude Console](https://platform.claude.com/usage), under the organisation the key belongs to. /usage in Claude Code computes its cost locally at list price, so it's an estimate ([cost docs](https://code.claude.com/docs/en/costs)). If you keep the key for other work, set a workspace spend limit in the Console to cap what a forgotten export can cost. Extra charges on claude.ai, not in the Console, are a different thing: usage credits, which Pro and Max subscribers turn on under Settings › Usage to keep working past a plan limit. Which one you should be paying with in the first place, priced out, is in [Claude Code: API key or subscription?](https://shuriken.sh/guides/claude-code-api-vs-subscription). ## How Shuriken keeps a key off your plan # In Shuriken, a Claude sign-in and an API key are separate sources. Each Claude sign-in you add gets its own configuration directory, so signing in to one never replaces another. The agents Shuriken starts don't inherit the keys and tokens your shell exports. Before it starts an agent, Shuriken drops 20 credential variables from the environment it passes on, ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN and CLAUDE_CODE_OAUTH_TOKEN among them, plus ANTHROPIC_BASE_URL, unless the source you picked sets them itself. A line left in ~/.zshrc can't put a chat on a Console key. A key you added takes chats when you pick it with Use, or once every subscription is out if Switch to API keys (Sources › Switch settings) is on. That switch is off by default, and it works with several keys. With it on, each fallback run stops at its Spend cap per fallback, $25 by default, counted for that agent's provider across every key the run touches, not per key. A Switched to … card in the chat names the source that took over, and chats go back to a subscription when one has room. [API keys as a last resort](https://shuriken.sh/blog/api-keys-last-resort) explains how the cap counts. To try it with your own plans and keys, [download Shuriken](https://shuriken.sh/download). Share [X](https://x.com/intent/post?url=https%3A%2F%2Fshuriken.sh%2Fguides%2Fclaude-code-using-api-key-instead-of-subscription&text=Claude%20Code%20using%20your%20API%20key%2C%20not%20your%20plan%3F%20Fix%20it)[LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fshuriken.sh%2Fguides%2Fclaude-code-using-api-key-instead-of-subscription)[Hacker News](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fshuriken.sh%2Fguides%2Fclaude-code-using-api-key-instead-of-subscription&t=Claude%20Code%20using%20your%20API%20key%2C%20not%20your%20plan%3F%20Fix%20it)[Reddit](https://www.reddit.com/submit?url=https%3A%2F%2Fshuriken.sh%2Fguides%2Fclaude-code-using-api-key-instead-of-subscription&title=Claude%20Code%20using%20your%20API%20key%2C%20not%20your%20plan%3F%20Fix%20it)[E-mail](mailto:?subject=Claude%20Code%20using%20your%20API%20key%2C%20not%20your%20plan%3F%20Fix%20it&body=https%3A%2F%2Fshuriken.sh%2Fguides%2Fclaude-code-using-api-key-instead-of-subscription) ## Sources - [Claude Code docs: Authentication precedence](https://code.claude.com/docs/en/authentication#authentication-precedence) (accessed 24 October 2026) - [Claude Code docs: Error reference](https://code.claude.com/docs/en/errors) (accessed 24 October 2026) - [Claude Code docs: Environment variables](https://code.claude.com/docs/en/env-vars) (accessed 24 October 2026) - [Claude Code docs: Settings reference (env, apiKeyHelper)](https://code.claude.com/docs/en/settings-reference) (accessed 24 October 2026) - [Claude Code docs: CLI reference (claude auth status)](https://code.claude.com/docs/en/cli-reference) (accessed 24 October 2026) - [Claude Code docs: Manage costs effectively](https://code.claude.com/docs/en/costs) (accessed 24 October 2026) - [Claude Help Center: Using Claude Code with your Pro or Max plan](https://support.claude.com/en/articles/11145838-use-claude-code-with-your-pro-or-max-plan) (accessed 24 October 2026) - [Claude Help Center: Managing API key environment variables in Claude Code](https://support.claude.com/en/articles/12304248-manage-api-key-environment-variables-in-claude-code) (accessed 24 October 2026) ## Frequently asked questions **Why is Claude Code charging my API account when I pay for Max?** An ANTHROPIC_API_KEY is set where Claude Code starts, and either you approved it once or you ran claude -p, which uses it without asking. Anthropic's help page says Claude Code then uses the key instead of your subscription and the usage is billed as API usage. Unset it, remove it from your shell profile, and check /status. **Where is the Use custom API key toggle?** In /config, and only while ANTHROPIC_API_KEY is set in your environment. Turning it off stops interactive sessions from using the key. It has no effect on claude -p, which always uses the key when it is present. **Does CLAUDE_CODE_OAUTH_TOKEN bill the API?** No. A token from claude setup-token runs on a subscription, but it can be a different one from your /login: every new session reads the variable again until you remove it from your shell profile or a settings env block. **Does the VS Code extension read ANTHROPIC_API_KEY too?** Yes. ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN and apiKeyHelper apply to the CLI and the surfaces that wrap it, including the VS Code extension and the Agent SDK. Claude Desktop and cloud sessions don't read them. **How do I see what the key has already cost?** Open the Usage page in the Claude Console for the organisation the key belongs to. The cost figure in Claude Code's /usage is an estimate at list price, and Anthropic points to the Console for billing. Fuel All your plans, in one fuel gauge. Shuriken adds up what your subscriptions have left, one figure per provider and per limit, in the top bar. [Download](https://shuriken.sh/download) [Other platforms](https://shuriken.sh/download#main) ## Keep reading - [Claude Max 5x vs 20x (2026): what you really get: Guide 27 Oct 2026 6 min read Claude Max 20x gives 20 times Pro's 5-hour allowance and Max 5x five. Anthropic publishes no weekly multiplier; users report 20x at 1.5 to 2 times 5x.](https://shuriken.sh/guides/claude-max-vs-max-20x) - [Claude Team seats for Claude Code, explained: Guide 27 Oct 2026 5 min read Team Standard seats get 1.25x Pro's usage per session, Premium 6.25x, each with a 5-hour and weekly limit. Prices, Team vs Max, and a personal plan.](https://shuriken.sh/guides/claude-team-seats-for-claude-code) - [Claude Pro vs Max for Claude Code: Guide 27 Oct 2026 5 min read Pro suits a few Claude Code sessions a week; Max suits daily heavy use and parallel agents. Prices, limits, the signs you've outgrown Pro, and upgrading.](https://shuriken.sh/guides/claude-pro-vs-max-for-claude-code) - [Claude Code 1M context window: when it helps, what it costs: Guide 27 Oct 2026 4 min read Opus 4.7+, Sonnet 5+, Haiku 5.5 and Fable run with a 1M context in Claude Code by default. Why a huge session costs more every turn, and when /clear wins.](https://shuriken.sh/guides/claude-code-1m-context-window) - [Claude Code with Amazon Bedrock or Google Vertex AI: Guide 27 Oct 2026 7 min read Run Claude Code with Amazon Bedrock or Vertex AI: the env vars, the model IDs to pin, IAM, and what works differently from a Claude plan.](https://shuriken.sh/guides/claude-code-bedrock-vertex) - [What Claude Code costs per developer, per month: Guide 27 Oct 2026 5 min read Claude Code cost per developer per month: Anthropic's average is $150 to $250 at API rates. How it compares with Pro, Max and Team seats, with the maths.](https://shuriken.sh/guides/claude-code-cost-per-developer) - [Opus vs Sonnet for coding: which Claude model to use: Guide 27 Oct 2026 6 min read Opus vs Sonnet for coding: Sonnet 5.5 for well-scoped work, Opus 5.5 for long or open-ended jobs. Opus costs twice as much per token; judge it per task.](https://shuriken.sh/guides/opus-vs-sonnet-for-coding) ## Free tools - [Claude limit reset tracker](https://shuriken.sh/tools/limit-resets/claude) - [Codex limit reset tracker](https://shuriken.sh/tools/limit-resets/codex)