Configure Anthropic

from keycardai.oauth import Client, BasicAuth
from anthropic import Anthropic, WorkloadIdentityCredentials

# 1. Get a Keycard OIDC token scoped to Anthropic.
with Client(
    "https://<zone-id>.keycard.cloud",
    auth=BasicAuth("<your-client-id>", "<your-client-secret>"),
) as kc:
    token = kc.exchange_token(
        grant_type="client_credentials",
        resource="https://api.anthropic.com",
    )

# 2. Use it with the Anthropic SDK — WIF exchange happens automatically.
client = Anthropic(
    credentials=WorkloadIdentityCredentials(
        identity_token_provider=lambda: token.access_token,
        federation_rule_id="<fdrl_...>",
        organization_id="<anthropic-org-id>",
        service_account_id="<svac_...>",
        workspace_id="<wrkspc_...>",
    ),
)

message = client.messages.create(
    model="claude-sonnet-4-6",
    max_tokens=1024,
    messages=[{"role": "user", "content": "Hello from a Keycard workload"}],
)
print(message.content[0].text)

import Anthropic from "@anthropic-ai/sdk";
import { oidcFederationProvider } from "@anthropic-ai/sdk/lib/credentials/oidc-federation";

/** Get a resource-scoped JWT via client_credentials grant. */
async function keycardClientCredentials(
  tokenUrl: string, clientId: string, clientSecret: string, resource: string,
): Promise<string> {
  const resp = await fetch(tokenUrl, {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded",
      Authorization: `Basic ${btoa(`${clientId}:${clientSecret}`)}`,
    },
    body: new URLSearchParams({ grant_type: "client_credentials", resource }),
  });
  if (!resp.ok) throw new Error(`client_credentials failed: ${await resp.text()}`);
  const data = (await resp.json()) as { access_token: string };
  return data.access_token;
}

// 1. Get a Keycard OIDC token scoped to Anthropic.
const tokenUrl = "https://<zone-id>.keycard.cloud/oauth/2/token";
const keycardJwt = await keycardClientCredentials(
  tokenUrl, "<your-client-id>", "<your-client-secret>", "https://api.anthropic.com",
);

// 2. Use it with the Anthropic SDK — WIF exchange happens automatically.
const client = new Anthropic({
  credentials: oidcFederationProvider({
    identityTokenProvider: () => keycardJwt,
    federationRuleId: "<fdrl_...>",
    organizationId: "<anthropic-org-id>",
    serviceAccountId: "<svac_...>",
    workspaceId: "<wrkspc_...>",
    baseURL: "https://api.anthropic.com",
    fetch,
  }),
});

const message = await client.messages.create({
  model: "claude-sonnet-4-6",
  max_tokens: 1024,
  messages: [{ role: "user", content: "Hello from a Keycard workload" }],
});
console.log(message.content[0].text);

package main

import (
  "context"
  "fmt"
  "log"

  "github.com/anthropics/anthropic-sdk-go"
  "github.com/anthropics/anthropic-sdk-go/option"
  "github.com/keycardai/credentials-go/oauth"
)

func main() {
  ctx := context.Background()

  // 1. Get a Keycard OIDC token scoped to Anthropic.
  kc := oauth.NewClientCredentialsClient(
    "https://<zone-id>.keycard.cloud",
    oauth.WithCCBasicAuth("<your-client-id>", "<your-client-secret>"),
  )

  keycardToken, err := kc.RequestToken(ctx, oauth.ClientCredentialsRequest{
    Resource: "https://api.anthropic.com",
  })
  if err != nil {
    log.Fatal(err)
  }

  // 2. Use it with the Anthropic SDK — WIF exchange happens automatically.
  client := anthropic.NewClient(
    option.WithFederationTokenProvider(
      func(_ context.Context) (string, error) {
        return keycardToken.AccessToken, nil
      },
      option.FederationOptions{
        FederationRuleID: "<fdrl_...>",
        OrganizationID:   "<anthropic-org-id>",
        ServiceAccountID: "<svac_...>",
        WorkspaceID:      "<wrkspc_...>",
      },
    ),
  )

  message, err := client.Messages.New(ctx, anthropic.MessageNewParams{
    Model:     "claude-sonnet-4-6",
    MaxTokens: 1024,
    Messages: []anthropic.MessageParam{
      anthropic.NewUserMessage(anthropic.NewTextBlock("Hello from a Keycard workload")),
    },
  })
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(message.Content[0].Text)
}