Claude Code CLI Setup

Confirming the binary is on PATH

Before touching any environment variables, confirm the Claude Code binary is reachable from your shell. This is the first thing to check after a fresh install.

claude --version

If the shell returns a version string, the binary is on PATH and you can move directly to setting the API key. If it returns "command not found", the npm global bin directory is not in your PATH. The fix is a one-line addition to your shell profile.

Finding and fixing a missing PATH entry

First, find out where npm puts its global binaries.

npm prefix -g
# typical output on macOS: /usr/local
# or with nvm: /Users/you/.nvm/versions/node/v20.11.0

The binary lives in the bin subdirectory of that prefix. Add it to PATH in your shell profile.

# For macOS / Linux — add to ~/.zshrc or ~/.bash_profile:
export PATH="$(npm prefix -g)/bin:$PATH"

# Reload:
source ~/.zshrc

# Verify:
claude --version

On Windows, the path to add is typically C:\Users\<YourName>\AppData\Roaming\npm. Add it via System Properties > Environment Variables > User PATH, then close and reopen PowerShell.

Setting ANTHROPIC_API_KEY

The CLI reads ANTHROPIC_API_KEY to authenticate every API request. It must be set before the first run or every call will fail with a 401 error. The key string starts with sk-ant- and is generated in your account's API keys section.

macOS and Linux

# Add to ~/.zshrc (zsh) or ~/.bash_profile (bash):
export ANTHROPIC_API_KEY="sk-ant-your-key-here"

# Reload:
source ~/.zshrc

Windows PowerShell

# Open your PowerShell profile:
notepad $PROFILE

# Add this line and save:
$env:ANTHROPIC_API_KEY = "sk-ant-your-key-here"

# Reload:
. $PROFILE

Never commit the key to version control. For project-level configuration, create a .env file in the project root, add ANTHROPIC_API_KEY=sk-ant-..., and add .env to .gitignore. The CLI reads .env files automatically when present in the working directory.

Running the auth check

After setting the key and reloading the profile, run the auth check to confirm everything is working before opening a project.

claude auth

A successful auth prints a confirmation line with the account email. A 401 means the key is invalid or was not loaded — print the variable to check: echo $ANTHROPIC_API_KEY on macOS/Linux or echo $env:ANTHROPIC_API_KEY on PowerShell. A network error means the request is not reaching the API endpoint, which typically means a proxy is intercepting the traffic.

All supported environment variables

The table below lists every environment variable the CLI reads, its scope, and the default behaviour when it is not set.

Env variable	Scope	Default
ANTHROPIC_API_KEY	Required — authentication	None; CLI fails without it
CLAUDE_MODEL	Optional — model selection	Latest stable Sonnet unless overridden
HTTPS_PROXY	Optional — network routing	No proxy; direct HTTPS to API
NODE_EXTRA_CA_CERTS	Optional — TLS trust store	System trust store only
CLAUDE_SKIP_UPDATE_CHECK	Optional — CI / automation	Update check runs at session start
CLAUDE_CONFIG_DIR	Optional — config file location	~/.claude on macOS/Linux

Proxy configuration

Corporate networks often route outbound HTTPS through a proxy server. If claude auth fails with a network error rather than a 401, a proxy is the most likely cause.

# Set the proxy URL:
export HTTPS_PROXY=http://proxy.example.com:8080

# If the proxy uses a self-signed certificate:
export NODE_EXTRA_CA_CERTS=/path/to/corporate-ca.pem

Add both lines to your shell profile so they persist across sessions. The NODE_EXTRA_CA_CERTS path should point to a PEM-format certificate file. Your IT team can usually provide this file; it is the same certificate you would add to a browser's trust store for internal HTTPS sites.

CI and automation environments

In CI pipelines, set ANTHROPIC_API_KEY as a secret variable in your pipeline configuration rather than in a file. Most CI platforms (GitHub Actions, GitLab CI, CircleCI) have a secrets or environment variables section in the project settings — set the key there, then reference it in your pipeline YAML.

# GitHub Actions example:
env:
  ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
  CLAUDE_SKIP_UPDATE_CHECK: "1"

Set CLAUDE_SKIP_UPDATE_CHECK=1 in CI to suppress the update-available prompt, which would otherwise add noise to pipeline logs and could interrupt non-interactive runs waiting for user input.

Pinning a model via CLAUDE_MODEL

By default the CLI uses the latest stable Sonnet model unless the session or a config file overrides it. To pin a specific model across all sessions on a machine, set CLAUDE_MODEL in the shell profile.

export CLAUDE_MODEL="claude-opus-4-5"

You can still override this per-session with the --model flag. Teams that want reproducible behavior across developer machines often set CLAUDE_MODEL in a shared .env file at the project root, which the CLI reads automatically. For a comparison of available model identifiers, see the models overview.

The NIST AI Risk Management Framework is worth reading when setting team policies around API key handling and model pinning in regulated environments, as it provides a structured vocabulary for documenting those decisions.