Claude Code
Create a dedicated key and use the console-generated environment variables or ~/.claude/settings.json. Claude-compatible clients use the site root because the client appends /v1/messages; use ANTHROPIC_AUTH_TOKEN rather than placing a secret in a project file.
Before you begin
Install only the current client release from its official publisher. Before changing local configuration, create a dedicated API key in the console; never reuse a personal, shared, or production deployment key.
Windows, macOS, and Linux
- Windows: use the current Windows installer or PowerShell workflow, then close all client processes after changing a config file.
- macOS: use the signed app or official terminal installer for your CPU; home-directory settings belong to that macOS user.
- Linux / WSL: follow the current distribution or official CLI instructions; WSL reads its Linux home directory, not the Windows profile directory.
Choose a model
Call GET /v1/models with the dedicated key and choose one returned data[].id. This key-scoped list is authoritative; a model in a previous configuration, article, or client picker is not an access guarantee.
Configure
export ANTHROPIC_BASE_URL='https://ai.tavonilo.com'
export ANTHROPIC_AUTH_TOKEN='sk-...'
export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1Verify
Check the key with /v1/models, make one small non-sensitive request, and retain only the timestamp, route, model, HTTP status, and request ID for support. A timeout does not prove a billable generation was not processed, so do not blindly replay long or image requests.
Recover safely
- 401: replace an incomplete, revoked, or wrong key; never paste it into a support request.
- 403: check the key group, model visibility, balance, and route permission.
- 404: use the base URL shown here, not a full endpoint, and do not append /v1 twice.
- 429: queue work and honor Retry-After when present; do not replay a batch concurrently.
- 5xx or timeout: make a bounded retry only when the operation is safe to retry. Keep time, route, model, HTTP status, and request ID in redacted logs.
Credential boundary
Use one key per device or workload. Never send an API key, auth.json, full private prompt, password, verification code, or payment data to support; revoke and replace a key immediately when exposure is suspected.