---
title: "Anthropic"
description: "The default passthrough provider — forward the caller's own credential, inject an API key, or pool Claude subscription accounts with OAuth."
image: "https://shunt-docs.pages.dev/og.png"
---

> Documentation Index
> Fetch the complete documentation index at: https://shunt-docs.pages.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Anthropic

The built-in **`anthropic`** provider is shunt's default destination: any model with no matching
route is forwarded to `api.anthropic.com` unchanged (configurable via `server.default_provider`).
It is a **`kind = "anthropic"`** provider — the upstream already speaks the Anthropic Messages
API, so shunt passes the request through without translation and only decides **which credential**
goes upstream.

| Auth mode | Credential | Use case |
| :-- | :-- | :-- |
| `passthrough` (default) | the caller's own `x-api-key` / `Authorization` | transparent proxy — each client brings its own key or OAuth token |
| `api_key` | a server-side key from an env var | re-key every request with one operator-owned API key |
| `claude_oauth` | one or more shunt-managed Claude subscription accounts | spend Claude subscriptions, with pooling and quota-aware rotation |

## Quick start

Let a coding agent wire it up for you — `shunt add` prints an embedded setup blueprint
(offline and read-only; the agent edits the config, the command never does):

```bash
shunt add upstream anthropic --print | claude
```

Or follow the manual steps below.

## Configure the upstream

`anthropic` is built in — with no config at all, shunt already forwards unrouted models to it
as `passthrough`. To declare it explicitly (for ordered failover or to change auth), use the
preset, which supplies `kind = "anthropic"`, `base_url = "https://api.anthropic.com"`, and
`auth = "passthrough"`:

```toml
[[upstreams]]
name = "anthropic"
provider = "anthropic"
```

Explicit fields override preset defaults. The legacy `[providers.anthropic]` table form remains
supported — but do not mix `[[upstreams]]` and `[providers.*]` in one file.

### Passthrough (default)

Nothing else to configure: shunt forwards the client's own `x-api-key` or `Authorization`
header. No server-side secret belongs in the config. Which credential the *client* should send
is covered in [Connect Claude Code](/guides/connect-claude-code/#2-choose-the-anthropic-credential).

### Server-side API key

Inject an operator-owned key instead of trusting callers to bring one:

```toml
[[upstreams]]
name = "anthropic"
provider = "anthropic"
auth = { mode = "api_key", env = "ANTHROPIC_API_KEY", header = "x_api_key" }
```

If you inject a server-side credential, gate the gateway with
[`[server.auth]`](/guides/shared-gateway/) before exposing it beyond loopback.

### Claude subscription accounts (`claude_oauth`)

Create a refreshable shunt-managed account once, then scope the upstream to it:

```bash
shunt login claude --name primary --mode oauth
```

```toml
[[upstreams]]
name = "anthropic"
provider = "anthropic"
auth = { mode = "claude_oauth", account = "primary" }
```

`shunt login claude` has three modes: `--mode oauth` runs shunt's own refreshable OAuth flow
(recommended), `--mode import` copies the current Claude Code login, and `--mode setup-token`
creates a one-year inference-only token. Omit `account` (and `accounts`) to scan the whole
shunt-managed account store — with several accounts in the store this becomes a **load-balanced
pool** with session stickiness and quota-aware rotation. The full pooling behavior — explicit
account entries, per-account thresholds, `[server.pool]` tuning, and failover — is documented in
[Anthropic Multi-Account](/guides/anthropic-multi-account/).

> **Off-origin token guard**
>
> A `claude_oauth` upstream requires an HTTPS `base_url` on `anthropic.com` (or a subdomain), so a
> subscription bearer can never leak to another origin. Loopback hosts are exempt, for local mocks
> and debugging proxies.

## Models & routing

As the default provider, `anthropic` needs no routes — everything you did **not** map elsewhere
lands here. To pin a model to it explicitly inside an ordered failover chain:

```toml
[[models]]
id = "claude-sonnet-5"
display_name = "Claude Sonnet 5"

[models.upstream_model]
anthropic = "claude-sonnet-5"
```

The map key is the `[[upstreams]].name`, not the preset id. With
`auto_include_builtin_models = true` (the default), `GET /v1/models` also advertises shunt's
builtin Claude catalog — see [Model Discovery](/guides/model-discovery/).

## Verify

```bash
shunt check    # -> config ok
shunt run
curl -sS http://127.0.0.1:3001/v1/models
```

Then send one minimal request (with `passthrough`, include your own credential; with
`claude_oauth`, omit it):

```bash
curl -sS http://127.0.0.1:3001/v1/messages \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H 'anthropic-version: 2023-06-01' \
  -H 'content-type: application/json' \
  -d '{"model":"claude-sonnet-5","max_tokens":16,"messages":[{"role":"user","content":"Reply with OK."}]}'
```

## Related

- [Anthropic Multi-Account](/guides/anthropic-multi-account/) — account pool, quota-aware selection, `[server.pool]`
- [Admin & Remote Provisioning](/guides/admin-remote-provisioning/) — provision accounts from a browser
- [Configuration Reference](/reference/configuration/#providersnameaccounts) — every account key

Source: https://shunt-docs.pages.dev/providers/anthropic/index.mdx