Skip to content

Authentication & API Key

401 Invalid API Key / invalid token

Symptom: the terminal returns 401 invalid x-api-key.

Cause: ANTHROPIC_BASE_URL is unset or wrong, so the request hits the official endpoint.

Fix: make sure ~/.claude/settings.json has the correct Base URL and API Key:

json
{
  "env": {
    "ANTHROPIC_BASE_URL": "https://your-request-address",
    "ANTHROPIC_API_KEY": "sk-***"
  }
}

Note: the Claude Code Base URL does not need a /v1 suffix.

401 invalid token — IDE or MCP overrode the config

Symptom: the API Key is correct but you keep getting 401. Common after installing IDE plugins like Cursor or Continue.

Cause: the IDE plugin or MCP server overwrote the apiKey / baseURL fields in settings.json.

Fix (choose one):

  • Recommended: reconfigure with CC Switch to overwrite the modified config in one click
  • Manual: check and fix the overwritten fields in ~/.claude/settings.json
  • Environment variables: set API Key and Base URL via system env vars (higher priority than config files, harder to override)

Prevention: re-verify Claude Code connectivity after installing a new IDE plugin or MCP.

401 invalid token after switching services

Symptom: you previously used another proxy service; after switching, the new config is correct but you still get 401.

Cause: the old service left system env vars behind (ANTHROPIC_BASE_URL, ANTHROPIC_API_KEY, ANTHROPIC_API_TOKEN), which take priority over config files.

Windows fix: Press Win + R → type sysdm.cpl → Advanced → Environment Variables, and delete ANTHROPIC_BASE_URL, ANTHROPIC_API_KEY, ANTHROPIC_API_TOKEN from both "User variables" and "System variables". Reopen the terminal. If it still fails, delete these config files and reconfigure with CC Switch:

C:\Users\<name>\.claude\claude.json
C:\Users\<name>\.claude\claude.json.backup

Mac / Linux fix: Edit ~/.zshrc or ~/.bashrc, remove old lines starting with export ANTHROPIC_, run source ~/.zshrc, then restart the terminal.

OAuth login conflict invalidates the API Key

Symptom: you previously completed the official OAuth login via claude in the terminal; after switching to a proxy API, the config is ignored and requests go straight to api.anthropic.com. Especially common on servers (CentOS / Ubuntu).

Cause: ~/.claude.json holds an OAuth token (primaryApiKey / oauthToken), which takes priority over the API Key in settings.json.

Fix:

bash
# Step 1: log out of OAuth
claude auth logout

# Step 2: write the proxy API config
cat > ~/.claude/settings.json << 'EOF'
{
  "env": {
    "ANTHROPIC_API_KEY": "sk-your-API-key",
    "ANTHROPIC_BASE_URL": "https://your-request-address"
  }
}
EOF

# Step 3: verify it was written
cat ~/.claude/settings.json

# Step 4: relaunch
claude

Prevention: on servers, write settings.json before the first claude run to avoid triggering the OAuth flow.

401 Invalid API Key format — Key contains invisible characters

Symptom: the Key looks correct but still returns 401 or Invalid format.

Cause: copying the Key from a PDF / web page / screenshot introduced zero-width spaces, non-breaking spaces, \r, etc., or OCR misread similar characters (0/O, 1/l/I).

Detect:

bash
echo "$ANTHROPIC_API_KEY" | cat -A
# Normal: only $ at end of line
# Abnormal: ^M$ or other extra characters

Fix: get the Key again via the console's "Copy" button — don't type it manually or route it through a PDF/screenshot. Assign without quotes:

bash
export ANTHROPIC_API_KEY=sk-ant-api03-your-key

403 Missing API Key / config conflict

Cause: the config file was modified accidentally, or multiple configs conflict.

Fix: reconfigure with CC Switch to overwrite the modified files.

Asked to authenticate / login prompt on startup

Make sure ANTHROPIC_BASE_URL and ANTHROPIC_API_KEY are set, and restart the terminal (close the whole window and reopen — not a new tab).

Environment variable priority

From highest to lowest: system env vars > ~/.claude.json (OAuth token) > ~/.claude/settings.json (written by CC Switch).

When troubleshooting, if editing settings.json has no effect, check for higher-priority env vars or OAuth leftovers first.