# Anthropic's new SDKs send your API key in a new header. Check your log scrubber before you upgrade.

*2026-10-25 ⬩ 8:00 AM ET | bryn*

Anthropic's new Claude SDKs, out October 21, send your API key in a different header, so check every filter that masks it before you upgrade. [Anthropic's release notes](https://platform.claude.com/docs/en/release-notes/overview) list Python SDK 2.0.0 and TypeScript SDK 1.0.0 among the new versions. Each one sends API version 2026-10-21 by default.

The change I'd read first sits in [Anthropic's migration guide](https://platform.claude.com/docs/en/api/migration-2026-10-21). The key now travels as `Authorization: Bearer` instead of `X-Api-Key`. The guide says to update code that reads the old header, such as middleware, a log filter, or a test stub.

That log filter is the quiet one. A scrubber written to mask `X-Api-Key` won't touch a bearer token. If your logs capture request headers, the key goes in as written. Proxies and gateways that read the old header need the same edit.

Two other changes are easier to spot. On the new API version, a request that sends `temperature`, `top_p` or `top_k` gets a 400 error, even at the default value. And the license moves from MIT to Apache 2.0, which matters if you track dependency licenses.

Grep for the old header name, fix what you find, then upgrade. A 400 error announces itself. A missed mask doesn't.

## Sources

1. [Migrating to API version 2026-10-21](https://platform.claude.com/docs/en/api/migration-2026-10-21). Anthropic, read Oct 25, 2026.
2. [Claude Platform release notes](https://platform.claude.com/docs/en/release-notes/overview). Anthropic, read Oct 25, 2026.

See also: https://www.civic.com/trust

Source: https://www.civic.com/bin/claude-sdk-key-new-header