Guide · Claude

Claude Code charged my API key instead of my subscription: why, and how to stop it

A Pro, Max, or Ultra login does not win if ANTHROPIC_API_KEY is set. Claude Code's own docs put that environment variable ahead of the subscription.

BillCurfew watches OpenAI, Anthropic, and OpenRouter. For Anthropic it needs an organization Admin API key. Individual Console accounts cannot list keys or read the usage report. It emails you when a daily cap or a spike trips. The check runs regularly. A manual kill works on every plan, including Free. On Anthropic that kill is a reversible disable. Free is one provider, one watched key, and email alerts, with no card. It is not a proxy, and it does not block the next request. Start free with one key, no card. Prices are on pricing. What we store is on security.

Checked against Anthropic's Claude Code help article and authentication docs, plus two GitHub issues. A GitHub report is what that person wrote, not an Anthropic billing record.

How to check which login is active

Run /status inside Claude Code. Anthropic's help article says that shows the authentication method that is active. The authentication docs say that when a login and an API key are both configured, /status marks the credential that is not in use. [1] [2] Outside Claude Code, the help article says to print the variable: echo $ANTHROPIC_API_KEY on macOS or Linux, echo %ANTHROPIC_API_KEY% in Windows CMD, or echo $env:ANTHROPIC_API_KEY in PowerShell. [1]

Why is Claude Code using API credits when I have a Pro, Max, or Ultra plan?

Anthropic's docs say Claude Code prioritizes an ANTHROPIC_API_KEY in the environment over a claude.ai subscription. After you approve the key, usage is billed at API pay-as-you-go rates on that key's account, even if you are logged in with Pro, Max, Ultra, Team, or Enterprise. In non-interactive mode (claude -p), the docs say the key is always used when it is present. [1] [2]

The authentication docs list credentials in order. Cloud provider flags and ANTHROPIC_AUTH_TOKEN rank above ANTHROPIC_API_KEY. The API key ranks above apiKeyHelper, CLAUDE_CODE_OAUTH_TOKEN, and the subscription login from /login. That subscription login is the default for Claude Pro, Max, Ultra, Team, and Enterprise. [2]

In interactive mode the docs say you are prompted once to approve or decline the key, and the choice is remembered. In non-interactive mode (claude -p), the key is always used when it is present. [2] The help article also says Claude Code asks during setup if it detects a key, and notifies you after login if both a subscription and an environment key are active. [1]

One exception is documented: cloud sessions always use the subscription. Setting ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN in the cloud environment does not override those credentials. [2]

Where the key hides

The help article says people forget a variable they added to a shell config file. On macOS that is often ~/.zshrc. On bash it is ~/.bash_profile. On Windows it can be a user environment variable. Changing the file does nothing until you restart the terminal. [1]

The authentication docs say ANTHROPIC_API_KEY applies to the CLI and to surfaces that wrap it, including the VS Code extension, the Agent SDK, and GitHub Actions. Claude Desktop and cloud sessions do not read that variable. [2]

A project .env is not documented as something Claude Code loads by itself. Issue #58083 is a Max subscriber who reported about $52 in API credits and attributed it to ANTHROPIC_API_KEY in a project .env. [3] Issue #53728 is another Max subscriber who reported about $20 across two interactive sessions, with the variable exported from a shell profile they also used for scripts. That report names a cron job and a CI step as reasons someone might have set the variable. It does not say cron or CI injects the key into Claude Code. [4]

The fix

Unset ANTHROPIC_API_KEY, restart the terminal so the shell no longer has the variable, and run /status again. While the variable is still set, /config has a Use custom API key toggle. That toggle is how you change the approve-or-decline choice Claude Code remembered. The toggle is not shown once the variable is unset. [1] [2]

On macOS or Linux the temporary command is unset ANTHROPIC_API_KEY. The help article also shows how to delete the line from ~/.zshrc. On Windows, clear it in the current shell and delete the user environment variable, then restart the terminal. [1]

If you have already been charged

The help article says to contact Claude's Support team. It does not promise a refund, and it does not document turning off auto-reload or a per-key usage page for this problem. Those steps are not documented here. [1]

The same trap with OpenRouter and OpenAI keys

A key in the environment is a key any process in that shell can use. OpenAI's spend-limit docs set a monthly cap on an organization or a project, not a daily cap on one key. OpenRouter can set a credit limit on one key, including a daily reset. Give each tool its own key so one leak or one agent maps to one cap. The comparison is on the spend limits compared page, and the daily setup is the daily budget per key guide.

FAQ

Why is Claude Code using API credits when I have a Pro, Max, or Ultra plan?

Anthropic's docs say Claude Code prioritizes an ANTHROPIC_API_KEY in the environment over a claude.ai subscription. After you approve the key, usage is billed at API pay-as-you-go rates on that key's account, even if you are logged in with Pro, Max, Ultra, Team, or Enterprise. In non-interactive mode (claude -p), the docs say the key is always used when it is present.

How do I see which login Claude Code is using?

Run /status inside Claude Code. Anthropic's help article says that shows the authentication method that is active. The authentication docs say that when a login and an API key are both configured, /status marks the credential that is not in use.

How do I switch Claude Code back to my subscription?

Unset ANTHROPIC_API_KEY, restart the terminal so the shell no longer has the variable, and run /status again. While the variable is still set, /config has a Use custom API key toggle. That toggle is how you change the approve-or-decline choice Claude Code remembered. The toggle is not shown once the variable is unset.

Sources

  1. Claude Help Center, Manage API key environment variables in Claude Code. https://support.claude.com/en/articles/12304248-manage-api-key-environment-variables-in-claude-code
  2. Claude Code docs, Authentication. https://code.claude.com/docs/en/authentication
  3. GitHub anthropics/claude-code issue 58083. https://github.com/anthropics/claude-code/issues/58083
  4. GitHub anthropics/claude-code issue 53728. https://github.com/anthropics/claude-code/issues/53728