lolcreds

Public credential defaults and exposure patterns for authorized security testing.

Anthropic Claude API

AnthropicAI API4 credentials

Credentials4 documented
01

Anthropic API Key

anthropic / api-key

Anthropic Claude API requests authenticate with an API key from the Anthropic Console. Anthropic documents x-api-key as the API-key header.

user definedsecretAPI key

Looks like

example
example

Anthropic Console API key form commonly seen for Claude API keys.

sk-ant-api03-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Location

environment
ANTHROPIC_API_KEY
http header
x-api-key, X-Api-Key

Anthropic API key header.

source code

application config, scripts, notebooks, examples, committed .env files

config file
.env

.env, local shell profiles, deployment manifests, server config

secret store

CI/CD variables, cloud secret managers, platform environment stores

logs

HTTP client debug logs that include x-api-key or Authorization headers

config file
.env, config.yml, config.yaml, values.yaml

Project-local configuration filenames; lower-confidence fallback scan targets

Notes

API keys and short-lived workload identity bearer tokens are different credential types. API keys are long-lived bearer secrets from Console; workload identity bearer tokens are obtained through the OAuth token endpoint and should be triaged by their identity provider and lifetime.

02

Anthropic Authorization Bearer Token

anthropic / auth-token

The official Python SDK can authenticate with a static bearer token via ANTHROPIC_AUTH_TOKEN. The SDK sends this value in the Authorization header.

user definedsecrettoken

Location

environment
ANTHROPIC_AUTH_TOKEN
http header
Authorization

Bearer token used by Anthropic SDK clients when auth_token is set.

source code

application config, scripts, notebooks, examples, committed .env files

config file
.env, config.yml, config.yaml, values.yaml

Project-local configuration filenames; lower-confidence fallback scan targets

secret store

CI/CD variables, cloud secret managers, platform environment stores

logs

HTTP client debug logs that include Authorization headers

Notes

This is distinct from the long-lived Console API key. The token value is opaque in official source, so no looks_like pattern is included.

03

Workload Identity Bearer Token

anthropic / workload-identity-bearer-token

Anthropic supports Authorization: Bearer *** for Workload Identity Federation. These are short-lived access tokens obtained from the Anthropic OAuth token endpoint rather than static Console API keys.

generated on installsecrettoken

Location

environment
ANTHROPIC_IDENTITY_TOKEN
http header
Authorization

Bearer token used for Anthropic Workload Identity Federation requests

config file
~/.config/anthropic/credentials/default.json

Default profile credentials file used by the Anthropic SDK on Linux and macOS; additional profile names use the same credentials directory but are omitted to avoid globs.

config file
%APPDATA%\Anthropic\credentials\default.json

Default profile credentials file used by the Anthropic SDK on Windows; additional profile names use the same credentials directory but are omitted to avoid globs.

logs

workload identity exchange logs and HTTP client debug output

secret store

workload runtime token caches and orchestration platforms

config file
.env, config.yml, config.yaml, values.yaml

Project-local configuration filenames; lower-confidence fallback scan targets

Notes

These tokens are intentionally short-lived and opaque. Exposure still matters during the token lifetime, and the upstream identity federation rule should be reviewed if tokens appear outside the intended workload. Workload identity also uses ANTHROPIC_IDENTITY_TOKEN_FILE, ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID, ANTHROPIC_SERVICE_ACCOUNT_ID, ANTHROPIC_WORKSPACE_ID, and ANTHROPIC_SCOPE; those metadata/path variables are not listed as credential-value environment locations except for ANTHROPIC_IDENTITY_TOKEN, which directly contains token material.

04

Webhook Signing Key

anthropic / webhook-signing-key

Anthropic SDK clients can load a webhook signing key from ANTHROPIC_WEBHOOK_SIGNING_KEY for webhook verification.

user definedsecretsecret value

Location

environment
ANTHROPIC_WEBHOOK_SIGNING_KEY
source code

application config and webhook verification code

config file
.env, config.yml, config.yaml, values.yaml

Project-local configuration filenames; lower-confidence fallback scan targets

secret store

CI/CD variables, cloud secret managers, platform environment stores

logs

webhook verification debug logs or environment dumps

Notes

The signing key shape is not specified in the checked official source, so no looks_like pattern is included.

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.