Skip to the board
DIDRESET
UTC

"Invalid API key · Fix external API key"

Updated

"Invalid API key · Fix external API key" means the ANTHROPIC_API_KEY environment variable or an apiKeyHelper script returned a key the API rejected, or Claude Code blocked a malformed key before sending it. It is an authentication error, not a usage limit: no window is full and no reset will clear it. Check the key in the Claude Console, run env | grep ANTHROPIC to find a stale key, or unset the variable and run /login to use your subscription.

Last reset
04 SEP 20:08Z

@lydiahallie

Status
OVERDUE

The gap since the last reset is past 1.5x the recent median.

Next est.
ANY TIME

Days since
13.1

days

What does "Invalid API key · Fix external API key" mean?

The Error reference lists this under authentication errors: "The ANTHROPIC_API_KEY environment variable or apiKeyHelper script returned a key the API rejected, or Claude Code blocked a key from ANTHROPIC_API_KEY before sending it." At the API level a rejected key is a 401 authentication_error, which the Platform docs describe as an issue with your API key, for example malformed, revoked or expired.

The word "external" matters: the key came from your environment, not from /login. Environment variables take precedence over a saved login, so a key exported in your shell profile or loaded from a .env file is used even when you have a working Pro or Max subscription. The docs note that direnv, dotenv shell plugins and IDE terminals can load a stale key without you setting it explicitly.

When the message continues with a description such as "it contains a line break at character 41", the API never saw the key: Claude Code found a character HTTP headers cannot carry and stopped the request. Either way, this is not a quota problem, and a reset will not solve it.

Which window is full?

Which window is full?
WindowResetsWhere to check
None: this is an authentication failure, not a usage windowNever; there is nothing to wait for/status shows which credential is active

What to do when you see it

  1. Check the key in the Console

    Look for typos and confirm the key has not been revoked at platform.claude.com/settings/keys.

  2. Find where the key comes from

    In the same shell run env | grep ANTHROPIC (PowerShell: Get-ChildItem Env:ANTHROPIC*). A .env file in the project, direnv or an IDE terminal may be supplying a stale key.

  3. Or switch to your subscription

    Unset ANTHROPIC_API_KEY and run /login to use subscription auth instead. The help center says /login switches you from Console pay-as-you-go to your subscription plan.

  4. If an apiKeyHelper supplies the key

    Run the script directly to confirm it prints a valid key on stdout, as the docs suggest.

  5. Confirm with /status

    It shows which credential source Claude Code is actually using, so you can see whether the fix took.

When does it reset?

Your own window: nothing resets here. The request was rejected before any usage was counted, so your five-hour and weekly windows are untouched. Once a valid credential is in place, /usage shows where they stand.

Account-wide resets: an official reset announced by Anthropic changes quotas, not credentials. The board above records those announcements; a bad API key stays bad through any reset.

Related errors

FAQ

Is "Invalid API key" a usage limit?

No. The Error reference lists it under authentication errors, and the underlying API code is 401 authentication_error, which the Platform docs describe as an issue with your API key. No window is involved; waiting for a reset changes nothing.

I have a Max subscription. Why is an API key being used at all?

Because environment variables take precedence over /login. If ANTHROPIC_API_KEY is exported in your shell profile or loaded from a .env file, Claude Code uses it once approved. Unset it and run /login to route through your subscription.

What does the text after "Fix external API key" mean?

When it continues with a description such as a line break at a given character position, Claude Code found a character HTTP headers cannot carry and stopped the request before sending it. The API never saw the key; fix the value in the variable or file it came from.

How do I know which credential Claude Code picked?

Run /status: it shows which credential source Claude Code is actually using. The authentication docs describe a fixed precedence when several are present: cloud provider variables first, then ANTHROPIC_AUTH_TOKEN, ANTHROPIC_API_KEY, apiKeyHelper, CLAUDE_CODE_OAUTH_TOKEN, profiles, and last the /login subscription.

Sources

  1. Claude Code docs: Error reference — "Invalid API key"verified 2026-09-18
  2. Claude Platform docs: API errors (401 authentication_error, 429 rate_limit_error)verified 2026-09-18
  3. Claude Code docs: Authentication — Authentication precedenceverified 2026-09-18
  4. Claude Console: API keysverified 2026-09-18
  5. Claude Help Center: Use Claude Code with your Pro or Max plan (/status, /login, shared limits)verified 2026-09-17

Want the next Claude reset on your phone?

Get alertedPage me

Sponsors