Anthropic

An Anthropic connection sends Claude models to the Claude API with your own credential, so Anthropic bills your organization for inference instead of Amp. Enterprise pricing can still add an Amp fee.

The connection authenticates with an API key by default. It can instead use workload identity federation, so Amp stores no key or secret. Both are the same kind of connection, with the same models and settings.

Set Up a Connection

Create an API key in the Claude Console. Then open personal model routing or workspace model routing, add an Anthropic connection, paste the key, and save.

If the key is enabled in more than one Claude Console workspace, open Workspace ID in the form and enter the workspace Amp should use (wrkspc_…). Anthropic bills usage to that workspace.

Use the Check Access button to confirm that Anthropic accepts the key.

You can also add the connection from the CLI, with the key in ANTHROPIC_API_KEY:

amp config model-providers add-key anthropic --workspace

Workload Identity Federation

With workload identity federation, Amp acts as a service account in your Anthropic organization. In the Claude Console, the Connect workload wizard registers Amp as an issuer and creates a federation rule that admits only tokens for your Amp workspace or user. Amp stores only the IDs of that trust. Before it sends requests, Amp signs a short-lived token and exchanges it with Anthropic for a short-lived access token. You need the admin, owner, or primary owner role in your Anthropic organization.

In the connection form, choose Workload Identity Federation as the authentication method. The form shows these steps with your own issuer and subject:

Sign in to see your own AMP_ISSUER and AMP_SUBJECT values.
  1. In the Claude Console, open Keys & access > Workload identity and choose Connect workload. Claude Console workload identity
  2. Issuer: choose Connect a new provider, then Custom OIDC. Name it amp , set the Issuer URL (iss claim) to AMP_ISSUER , and keep the JWKS source at OIDC discovery. Leave Discovery base URL and CA certificate empty and keep the Token validation defaults. Check The issuer's discovery document and JWKS are reachable from the public internet, then choose Apply and continue. If an issuer with this URL already exists, choose Use a registered issuer instead.
  3. Federation rule: set the Rule name to amp-model-routing , the Description to Amp model routing requests , and the Subject (sub) claim to AMP_SUBJECT . Leave Additional claim condition and Advanced match options empty: Anthropic already requires the audience https://api.anthropic.com, which Amp's tokens carry.
  4. Under Enable in workspaces, leave All workspaces unchecked and select the one workspace Amp should use. Keep the Advanced rule options at their defaults (OAuth scope workspace:developer and a 10-minute token lifetime), then choose Continue.
  5. Target: choose Create a new one, set the Service account name to amp-model-routing and the Description to Amp model routing requests , keep Workspaces at matches the federation rule, then choose Apply and continue.
  6. Test: skip the snippet under Run this from your workload; Amp makes this request itself. Copy organization_id, service_account_id, federation_rule_id, and workspace_id from the snippet into the Organization ID, Service Account ID, Federation Rule ID, and Workspace ID fields in Amp, with Workload Identity Federation selected as the authentication method. Save and run Check Access; the exchange shows up in the wizard under Authentication log. Then choose Done.

Anthropic bills usage to the workspace in the Workspace ID field. It is required only when the federation rule is enabled for more than one workspace, but entering it keeps billing explicit. Amp’s tokens last 30 minutes and are used once each, so the issuer’s default Enforce single-use tokens and Maximum token lifetime settings work as they are. Amp exchanges a new token whenever the 10-minute access token from the federation rule is about to expire.

From the CLI, print the same steps with amp config model-providers setup-guide anthropic --workspace, then add the connection:

amp config model-providers add-key anthropic --workspace \
  --anthropic-organization-id 00000000-0000-0000-0000-000000000000 \
  --anthropic-service-account-id svac_… \
  --anthropic-federation-rule-id fdrl_… \
  --anthropic-workspace-id wrkspc_…

To switch an existing connection between an API key and workload identity federation, edit it and choose the other authentication method. The connection keeps its ID, its model settings, and its place in the connection order.

For more, see Anthropic’s documentation on workload identity federation.