> For the complete documentation index, see [llms.txt](https://docs.onelens.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onelens.cloud/integrations/ai-integrations/claude-console-integration.md).

# Claude Console Integration

Customer Onboarding Guide: Claude Console Usage and Cost Admin API

### TL;DR

* **What this does:** Connects OneLens to your Claude Console (Claude Console, platform.claude.com) organization to break down Claude API spend by workspace, API key, model, service tier and cost type, plus per-user Claude Code cost.
* **Time required:** \~10 minutes
* **Who you need:** An organization member with the **admin** role in Claude Console (only admins can create Admin API keys).
* **What OneLens reads:** Token counts, USD costs, and Claude Code activity counters from Anthropic's Usage and Cost Admin API and Claude Code Analytics API. Your prompts, completions, files and model outputs are never accessed.

{% hint style="info" %}
**Using claude.ai (Claude Enterprise) instead?** Use the [Claude Enterprise Integration](https://docs.onelens.cloud/integrations/ai-integrations/claude-enterprise-integration). The two integrations use different keys, and the keys are not interchangeable. If you use both products, connect both.
{% endhint %}

### What You'll Get Once Connected

| Capability                  | What it does                                                                                                                  |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| Unified AI Cost Explorer    | Shows Claude API spend next to your cloud and other AI provider costs in one view.                                            |
| Workspace Cost Allocation   | Splits cost by Claude Console workspace, so each team or product line sees its own bill. Default workspace usage is labeled.  |
| API Key Attribution         | Breaks token usage down by API key, so you can trace spend to a specific app, service or environment.                         |
| Per-Model Cost Analysis     | Separates cost by model (Opus, Sonnet, Haiku) and context window tier.                                                        |
| Service Tier Breakdown      | Separates standard, batch and Priority Tier token usage. Shows how much traffic already gets the 50% batch discount.          |
| Prompt Cache Efficiency     | Compares cached input, cache creation and uncached input tokens per workspace and model, to show where caching is paying off. |
| Fast Mode & Data Residency  | Tracks fast mode usage and `inference_geo` (`us` vs `global`) as separate cost dimensions.                                    |
| Web Search & Code Execution | Reports web search and code execution costs as their own line items.                                                          |
| Claude Code Per-User Cost   | Shows estimated Claude Code cost and token usage per developer, by model, along with sessions, commits and PRs.               |
| Budget Alerts & Anomalies   | Flags spend spikes by workspace, key or model, and tracks spend against thresholds you set in OneLens.                        |

### Security at a Glance

| Question                                        | Answer                                                                                                                                                                                                                                                                                                                |
| ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Does OneLens read our prompts or model outputs? | No. The endpoints OneLens calls return token counts, dollar amounts, model names, and workspace and API key IDs. They return no prompt or response content.                                                                                                                                                           |
| Is the Admin API key read-only?                 | **No, and you should know this before you create it.** Claude Console Admin API keys have no selectable scopes. Every key can call every Admin API endpoint, including ones that manage members, workspaces and API keys. OneLens sends only `GET` requests to the endpoints listed under "What OneLens Will Access". |
| How do we limit the risk of a full-access key?  | Set an expiration when you create the key, give it a name that identifies OneLens, and revoke it from Settings > Admin keys whenever you want. OneLens stores it encrypted and never displays it after you save it.                                                                                                   |
| Can OneLens see our Claude API keys?            | No. The List API Keys endpoint returns key names, IDs and a partially redacted hint, never the secret. The Admin API cannot reveal or recover a usable Claude API key.                                                                                                                                                |
| What authentication is used?                    | An Admin API key (`sk-ant-admin01-...`) sent in the `x-api-key` header. It expires on the date you choose at creation, or never if you select Never.                                                                                                                                                                  |
| How is data transmitted and stored?             | All API calls use TLS 1.2+. Credentials and collected data are encrypted at rest with GCP KMS, and access to them inside OneLens is restricted.                                                                                                                                                                       |
| Can I restrict by IP?                           | Anthropic does not document IP allowlisting for Admin API keys. Access control comes from the admin role required to create the key, the key's expiration, and revocation.                                                                                                                                            |

### Cost of the Integration

OneLens creates nothing in your Claude Console organization. It reads reports from Anthropic's hosted Admin API.

| Item                    | What it is                                                                                                                        | Typical cost                        |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- |
| API calls               | About 5 calls per day: usage report (1), cost report (1), Claude Code report (1 per 1,000 users), workspace and API key names (2) | $0 (Admin API calls use no tokens)  |
| Data egress             | JSON responses, usually well under 5 MB per day                                                                                   | $0                                  |
| Compute in your account | None. OneLens calls Anthropic's hosted API                                                                                        | $0                                  |
| Storage in your account | None                                                                                                                              | $0                                  |
| **Estimated total**     | $0 + $0 + $0 + $0                                                                                                                 | **$0/month on your Anthropic bill** |

The first sync makes a few more calls to backfill the current month: usage report (1) + cost report (1) + Claude Code report (1 per day elapsed, up to 31) = 33 calls at most, also $0. Anthropic lists the Claude Code Analytics API as free for all organizations with Admin API access.

### How It Works

The Usage and Cost Admin API returns the same data you see on the Usage and Cost pages in Claude Console, at finer detail. OneLens reads three reports:

1. **Usage report** (`/v1/organizations/usage_report/messages`): token counts in daily buckets, grouped by workspace, API key, model, service tier, context window, inference geography and speed. Priority Tier usage appears only here.
2. **Cost report** (`/v1/organizations/cost_report`): USD cost per day, grouped by workspace and description (model, token type, web search, code execution). Amounts arrive as decimal strings in cents (for example, `"41280.000000"` is $412.80). OneLens parses them as exact decimals so large totals don't pick up rounding errors.
3. **Claude Code report** (`/v1/organizations/usage_report/claude_code`): one record per developer per day, with estimated cost by model, sessions, lines changed, commits and PRs.

OneLens also reads your workspace and API key lists once a day, only to show names instead of raw IDs in dashboards. Everything is normalized into the same cost model as your other AI providers.

### Prerequisites

* A Claude Console organization. The Admin API is not available for individual accounts; set up an organization under Console > Settings > Organization first.
* A member with the **admin** role in that organization.
* Your Claude API traffic goes to Anthropic directly (api.anthropic.com).

### What OneLens Will Access

| Endpoint                                         | Purpose                                                        |
| ------------------------------------------------ | -------------------------------------------------------------- |
| GET /v1/organizations/usage\_report/messages     | Daily token usage by workspace, API key, model and tier        |
| GET /v1/organizations/cost\_report               | Daily USD cost by workspace and cost description               |
| GET /v1/organizations/usage\_report/claude\_code | Per-user Claude Code cost, tokens and activity                 |
| GET /v1/organizations/workspaces                 | Workspace names for display (IDs only otherwise)               |
| GET /v1/organizations/api\_keys                  | API key names for display (returns a redacted hint, no secret) |

### What OneLens Will NOT Access

* Prompts, completions or any Messages API content
* Files, batches or anything stored in your workspaces
* The Compliance API Activity Feed, even though a Console Admin API key can reach it
* Member, invite, workspace or API key management (no create, update, archive or delete)
* Rate limit or spend limit configuration
* Any `POST`, `PUT`, `PATCH` or `DELETE` request

{% stepper %}
{% step %}

### Create an Admin API Key

1. Sign in to [Claude Console](https://platform.claude.com/) as an organization admin
2. Go to [Settings > Admin keys](https://platform.claude.com/settings/admin-keys)
3. Click **Create key** and name it **OneLens Integration**
4. Choose an expiration. We recommend "Never" or maximum expiration the organization supports, Console limits the choices to that maximum.
5. Click **Create**, then copy the secret (it starts with `sk-ant-admin01-`). Console shows it only once

{% hint style="warning" %}
**This is a full-access key.** Console Admin API keys cannot be scoped. Don't paste it into tickets, chat or email, and don't reuse a key that another tool already has. Create one key just for OneLens so you can revoke it without affecting anything else.
{% endhint %}
{% endstep %}

{% step %}

### Verify the Key Works

Run this from your terminal. Replace the dates with a recent 7-day window:

```bash
curl "https://api.anthropic.com/v1/organizations/cost_report?starting_at=2026-10-01T00:00:00Z&ending_at=2026-10-08T00:00:00Z&group_by[]=workspace_id" \
  --header "anthropic-version: 2023-06-01" \
  --header "x-api-key: YOUR_ADMIN_KEY_HERE"
```

A JSON response with a `data` array means the key works. An empty `results` list for every day means the key is valid but the organization had no billed usage in that window; pick a window when you know traffic ran.
{% endstep %}

{% step %}

### Connect to OneLens

Provide the following in the OneLens integration setup:

| Field             | Value                                           | Example                |
| ----------------- | ----------------------------------------------- | ---------------------- |
| Provider          | Anthropic (Claude Platform)                     | n/a                    |
| Admin API Key     | The key from Step 1                             | sk-ant-admin01-xxxx... |
| Organization Name | Your Claude Console organization name (display) | Acme Corp              |
| {% endstep %}     |                                                 |                        |

{% step %}

### Verify the Connection

After you save the key, OneLens runs three checks:

1. Calls the cost report for the last 7 days to confirm the key is valid and cost data is readable
2. Calls the usage report for the same window to confirm token data is readable
3. Lists workspaces to confirm names resolve

When all three pass, data starts appearing within 24 hours. OneLens backfills from the 1st of the current month (UTC) and collects daily from then on. Earlier months are not imported.
{% endstep %}
{% endstepper %}

### Data Refresh Schedule

| Data source                  | Polling cadence | Source-side latency                                       |
| ---------------------------- | --------------- | --------------------------------------------------------- |
| Usage report and cost report | Once daily      | Usually within 5 minutes of the request; sometimes longer |
| Claude Code report           | Once daily      | Up to 1 hour                                              |
| Workspace and API key names  | Once daily      | Immediate                                                 |

Anthropic's data is close to real time, but OneLens polls daily. Daily cost buckets are the finest grain the cost report supports, and polling more often would not change the daily totals. The current day's figures can still move until the day closes in UTC, so OneLens re-reads the previous day on each poll.

### Key Lifecycle

* Admin API keys expire on the date chosen at creation. Keys created with Never do not expire.
* Only organization admins can create Admin API keys, in Settings > Admin keys.
* An expired or revoked key stops OneLens polling right away. OneLens alerts you when polling starts failing.
* **Rotation:** Create a new key, update it in OneLens, then revoke the old one. OneLens uses the new key on the next daily poll, so there is no gap in data.

### Data Privacy & Security

* ✅ No prompt or completion content. Only token counts, costs, IDs and names
* ✅ `GET` requests only, to the five endpoints listed above
* ✅ Full-access key risk disclosed up front, with expiration and one-click revocation as the controls
* ✅ TLS 1.2+ for all data in transit
* ✅ GCP KMS encryption for credentials and collected data at rest
* ✅ API key secrets never collected. OneLens sees names and redacted hints only
* ✅ Claude Code developer emails used only for per-user cost attribution
* ✅ **Data retention:** 12 months by default, configurable. Deletion within 30 days of a request, with confirmation

### Need Help?

**Anthropic Documentation:**

* [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api)
* [Create an Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys)
* [Claude Code Analytics API](https://platform.claude.com/docs/en/manage-claude/claude-code-analytics-api)
* [Admin API overview](https://platform.claude.com/docs/en/manage-claude/admin-api)
* [Pricing](https://platform.claude.com/docs/en/about-claude/pricing)

**OneLens Support:** <support@astuto.ai> · Security: <security@astuto.ai>

### Troubleshooting

| Symptom                                                | Cause                                                                                           | Fix                                                                                                    |
| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| `401` authentication error                             | Key is wrong, expired or revoked, or it's a regular `sk-ant-api03-` key instead of an Admin key | Create a new key in Settings > Admin keys and confirm it starts with `sk-ant-admin01-`                 |
| `401` or `403` with a key from claude.ai               | A Claude Enterprise Analytics key was used. It can't call the Admin API                         | Use the Claude Enterprise integration for that key, or create a Console Admin key for this one         |
| Error that the Admin API is unavailable                | The Console account is an individual account, not an organization                               | Set up an organization in Console > Settings > Organization, then create the key                       |
| Org runs on Claude Platform on AWS and no data arrives | Anthropic does not offer these endpoints on Claude Platform on AWS                              | Not supported yet. Use the Console Usage and Cost pages, or contact OneLens support                    |
| Workspace shows as "Default" or blank                  | Usage in the default workspace has a `null` `workspace_id`                                      | Expected. Move apps into named workspaces if you want them allocated separately                        |
| API key shows as "Console / Playground"                | Playground usage in Console has no API key, so `api_key_id` is `null`                           | Expected. No action needed                                                                             |
| OneLens total is lower than the Anthropic invoice      | Priority Tier costs are not in the cost report                                                  | OneLens estimates Priority Tier from usage tokens. Use your invoice for the exact Priority Tier amount |
| `429` rate limit errors                                | Another tool is polling the Admin API heavily from the same organization                        | OneLens retries automatically. If it persists, reduce polling from other tools                         |
| Connected, but no data after 24 hours                  | No billed usage since the 1st of the month, or the key expired after setup                      | Run the Step 2 command with a window you know had traffic. If it fails, rotate the key                 |

### Appendix: Other Admin Credentials

The Admin API also accepts an OAuth token with the `org:admin` scope, or a personal or service account API key that isn't scoped to a workspace. We don't recommend either for OneLens. A non-workspace API key can also call the Messages API, so a leaked key could run up model charges as well as reach admin endpoints. A dedicated Admin API key does the job with nothing extra attached.

### Frequently Asked Questions

<details>

<summary>Can OneLens see our prompts, completions or files?</summary>

No. OneLens calls only the five endpoints listed above. They return token counts, costs, model names and IDs, never request or response content.

</details>

<details>

<summary>The key has full admin access. Can OneLens change our organization?</summary>

The key technically allows it, because Anthropic doesn't offer scoped Admin keys for Claude Console. OneLens only sends `GET` requests to the listed endpoints and never calls endpoints that create, update or delete anything. If your policy requires a technically read-only credential, tell us and we'll walk your security team through the controls, or revisit when Anthropic adds scopes.

</details>

<details>

<summary>Will this affect our Claude API rate limits or performance?</summary>

No. OneLens makes about five Admin API calls per day. They use no model tokens and don't touch your Messages API traffic.

</details>

<details>

<summary>Can we see cost per user?</summary>

For Claude Code, yes. The Claude Code report gives estimated cost per developer email. For general Messages API traffic, Anthropic reports by API key and workspace, not by person. To allocate that spend, give each team, app or environment its own key or workspace.

</details>

<details>

<summary>We use both Claude Console and Claude Enterprise. What do we connect?</summary>

Both, separately. Create a Console Admin key for this integration and an Analytics key in claude.ai for the [Claude Enterprise Integration](https://docs.onelens.cloud/integrations/ai-integrations/claude-enterprise-integration). The two key types don't work across products.

</details>

<details>

<summary>Can I connect multiple Claude Console organizations?</summary>

Yes. A key only works for the organization it was created in, so add each organization in OneLens with its own Admin API key.

</details>

<details>

<summary>How do I disconnect OneLens?</summary>

Revoke the OneLens key in Claude Console > Settings > Admin keys. Access stops immediately. Then remove the integration in OneLens and request data deletion if you want historical data removed.

</details>

<details>

<summary>How do I rotate the key?</summary>

Create a new Admin key, update it in OneLens, then revoke the old one. OneLens picks up the new key on the next daily poll, with no data gap. We recommend a 90-day expiration so rotation is enforced.

</details>

<details>

<summary>Does OneLens see email addresses?</summary>

Only in the Claude Code report, which identifies developers by email (or by API key name when they use an API key). OneLens uses these for per-user cost attribution. Contact support if your policy requires anonymization.

</details>

<details>

<summary>How far back does OneLens pull historical data?</summary>

To the 1st of the month you connect in (UTC). From then on OneLens collects every day, so history builds up from that point. Months before you connected are not imported. Claude Console's Usage and Cost pages still show them.

</details>

<details>

<summary>We use Priority Tier. Will we see those costs?</summary>

Yes, as an estimate. Anthropic leaves Priority Tier out of the cost report and only reports its token usage. OneLens takes those tokens and applies list prices. Priority Tier is billed under a separate commitment, so the estimate can differ from what you're actually charged. Use your Anthropic invoice for the exact Priority Tier amount.

</details>

<details>

<summary>Why are code execution costs missing from token usage?</summary>

Anthropic reports code execution only in the cost report, under the `Code Execution Usage` description. OneLens shows it as its own cost line.

</details>

<details>

<summary>What about Claude usage through Amazon Bedrock, Google Vertex AI or Microsoft Foundry?</summary>

Those are billed by the cloud provider and don't appear in Claude Console. Use the AWS Bedrock integration for Bedrock and the GCP integration for Vertex AI.

</details>

***

*Reference sources:* [*Usage and Cost API*](https://platform.claude.com/docs/en/manage-claude/usage-cost-api) *·* [*Create an Admin API key*](https://platform.claude.com/docs/en/manage-claude/admin-api-keys) *·* [*Claude Code Analytics API*](https://platform.claude.com/docs/en/manage-claude/claude-code-analytics-api) *·* [*Authentication and key expiration*](https://platform.claude.com/docs/en/manage-claude/authentication) *·* [*Get your Claude API key*](https://platform.claude.com/docs/en/get-api-key)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.onelens.cloud/integrations/ai-integrations/claude-console-integration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.