Anthropic adds personal keys and service account keys to the Claude Console

Anthropic rolled out two new API key types for the Claude Console on August 27, 2026: personal keys and service account keys, giving organizations a way to tie API usage to a specific person or automated identity rather than only to a shared workspace.

What's new

Per Anthropic's Claude Platform release notes: "You can now create personal keys and service account keys in the Claude Console. They act as you or as a service account, with the same permissions, and stop working when the linked account is removed from an organization."

Key details from the release notes:

• Personal keys inherit the permissions of the individual user who creates them; service account keys act on behalf of a designated non-human identity.
• Both key types automatically stop working once the linked account is removed from the organization, closing off a common source of orphaned, still-valid API credentials.
• Admins can scope these keys to a specific workspace, or grant them access to admin endpoints and across any workspace the parent account can reach.
• Workspace API keys — the prior model, where a key belonged to a workspace rather than a person or service identity — remain supported as a legacy option, so existing integrations don't break.

The change shipped alongside other Claude Platform updates the same week, including Admin API access via the ant CLI and SDKs for organization, member, workspace, and encryption-key management.

Context

Until now, Claude API keys were primarily scoped to workspaces, which made it harder for organization admins to answer a basic security question: which specific person or service actually made a given API call. As enterprises adopt Claude more broadly — including through Claude Enterprise, Claude Managed Agents, and the Admin API — that gap becomes more consequential, since a leaked or misused workspace key can't easily be traced to an individual.

Why it matters

This is a governance and audit feature, not a model capability, but it matters for the same reason SSO and role-based access control matter: enterprise buyers increasingly require per-identity accountability before they'll expand API usage. By making keys expire automatically when an account is deprovisioned, Anthropic also closes a common security gap — stale credentials that keep working after an employee leaves. It's a small release relative to model launches, but it signals Anthropic continuing to build out the administrative and compliance tooling that enterprise customers ask for as a condition of scaling deployments.