PRODUCTION SCENARIO
A CI pipeline authenticates to the Claude API with a personal API key that a senior engineer created. That engineer is leaving the company next month.
What should the team switch the pipeline to?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: A service account key or Workload Identity Federation, giving CI its own identity
A shared personal key acts as one person and breaks when that person leaves, so an automated workload should authenticate as a service account or federate a platform-issued identity, which is what the docs recommend for CI and production services. Handing the key to another engineer just moves the same failure to the next departure. Expiration is not the mechanism that ends a personal key, since personal keys are archived when their user is removed regardless of expiry. And archived keys are never restored.
Official Source: https://platform.claude.com/docs/en/manage-claude/authentication ↗