Connect your Claude account

CostAssured reads your organisation's usage and cost reports and the inventory of workspaces and API keys behind them. It writes nothing. This guide takes about five minutes and needs somebody with the organisation admin role in the Anthropic Console.

1. Choose the key type

Preferred: a service account key. An organisation admin creates a service account in Console > Settings > Service accounts and creates an API key linked to it. The key's scope is what matters, not the service account's role: set the scope to the organisation, not a workspace. A workspace-scoped key sees only that workspace, and the reports CostAssured reads are organisation wide. A key not linked to a service account is refused too. This is the least privilege the platform will issue for this job, and the key is attributable to a named service account rather than to a person.

Alternative: an Admin API key. Console > Settings > Admin keys. Use this when the service account key cannot read the usage report or the cost report, which is the one thing CostAssured cannot work without. An Admin API key carries full organisation privilege, so prefer the service account whenever its probes pass.

Either key starts with sk-ant-. CostAssured accepts sk-ant-svc- (service account), sk-ant-admin01- and sk-ant-api03- keys.

2. Why there is no read-only option

Anthropic issues no read-only admin credential. There is no scoping to ask for and no permission to leave unticked, so CostAssured cannot prove read-only by having the platform refuse a write, the way it can on a platform that scopes its keys. What it can do is be specific about what it reads and leave you the evidence.

CostAssured performs reads only. It calls five endpoints:

Nothing else. No message content, no prompts, no completions, and no write of any kind. Every one of those calls appears in your Console audit log under the key you create, which is the independent proof: name the key for CostAssured and the log tells you exactly what it did and when.

3. Create the key

1. Create the service account, or open Admin keys, as described in step 1.
2. Name the key so it is obvious later. costassured reads well in an audit log; a key named test-3 does not.
3. Choose an expiry your organisation is happy to rotate on, and put the rotation in the calendar. A key with no expiry is a key nobody revisits.
4. Copy the key immediately. Anthropic shows it once.

4. Paste it into CostAssured

Paste the key into the connect form. CostAssured runs one read probe per capability and shows you the result before storing anything.

• Organisation, usage and cost must all pass. Usage is what there is to analyse, and cost is where the billed amount behind every saving comes from. A key that reads usage but not cost is refused with that reason, because pricing findings off a published list card rather than off your own invoice would be a different and weaker claim.
• Workspaces and keys are advisory. If either read is refused the scan still runs, and a finding names a workspace or a key by its id rather than by the name you gave it.
• A refusal is a permission fact, not a mistake you made. CostAssured tells you which read was refused and what to change. A timeout says nothing about permission and is reported as what it is: a call that did not come back.

Every connection also records that this key is not read-only scoped, and says so on the connection. Keys are stored encrypted and are decrypted only inside scan workers, never in a browser.

Revoking access

Disable or delete the key in the Anthropic Console at any time. CostAssured stops immediately: the next call is refused and the connection reports it. Revoking the connection in CostAssured destroys the stored secret in the same transaction. Doing both is the belt and braces version, and the audit log shows the last call either way.