---
title: "Claude Code Setup for Security Models: Base URL and Key"
canonical: https://pentestllm.ai/agents/claude-code
generated: 2026-11-11T18:03:33.568Z
source: https://pentestllm.ai/agents/claude-code
base_url: https://api.pentestllm.ai/v1
---

![Patch cables in a network switch](https://pentestllm.ai/img/cables.webp)

## Steps

1. ### Export the base URL and the key
   Create a key in the PentestLLM console. In the terminal that will run Claude Code, set the two variables. The base URL has no `/v1`: Claude Code adds `/v1/messages` itself. `ANTHROPIC_AUTH_TOKEN` sends the key as a bearer token, and while it is set, requests carry that credential in place of a claude.ai login.
   shell
   ```
   export ANTHROPIC_BASE_URL=https://api.pentestllm.ai
   export ANTHROPIC_AUTH_TOKEN=sk-ptl-live-…
   ```
2. ### Verify the endpoint with one request
   Claude Code’s docs recommend a direct request before opening the agent, so a failure points at the endpoint and not at your setup. A JSON answer with a `content` field means the URL and the key work. A 401 means the key is wrong.
   shell
   ```
   curl -sS -X POST "$ANTHROPIC_BASE_URL/v1/messages" \
     -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
     -H "anthropic-version: 2023-06-01" \
     -H "content-type: application/json" \
     -d '{"model": "auto/security", "max_tokens": 16, "messages": [{"role": "user", "content": "Reply with the single word ok."}]}'
   ```
3. ### Start Claude Code on a security model
   Launch with `--model`, or set `ANTHROPIC_MODEL` to have it apply to every launch from that shell. Inside the session, `/status` should show your base URL and the auth token as the credential in use.
   shell
   ```
   claude --model auto/security
   ```
4. ### Make it persistent, for this machine only
   To keep the setup across terminals, put the variables in the `env` block of `~/.claude/settings.json`. Do not put the key in a project’s `.claude/settings.json`: that file is committed with the repository. If you also use Claude Code with Claude models, keep this in shell exports instead, so only the terminal you choose is redirected.
   ~/.claude/settings.json
   ```
   {
     "env": {
       "ANTHROPIC_BASE_URL": "https://api.pentestllm.ai",
       "ANTHROPIC_AUTH_TOKEN": "sk-ptl-live-…",
       "ANTHROPIC_MODEL": "auto/security"
     }
   }
   ```

## Read this first: what is unsupported

Anthropic’s gateway documentation, read on 11 November 2026, says it does not support routing Claude Code to non-Claude models through any gateway. This setup works because PentestLLM’s endpoint accepts the Messages format and translates it for its builds. It is your configuration to maintain, and a Claude Code update can change what the agent sends.

Some things are lost in translation. Extended thinking settings and prompt cache controls are dropped, because the builds behind the endpoint have no equivalent. Claude Code also makes a few checks directly against Anthropic’s own API, such as its fast mode availability check, whatever base URL you set.

## What each variable does

- ANTHROPIC_BASE_URL: The endpoint Claude Code sends Messages requests to. `https://api.pentestllm.ai`, without a path.
- ANTHROPIC_AUTH_TOKEN: Your PentestLLM key, sent in the `Authorization: Bearer` header.
- ANTHROPIC_API_KEY: The alternative credential variable, sent in `x-api-key`. The endpoint accepts either; set one, not both.
- ANTHROPIC_MODEL: The model for sessions started from this environment: `auto/security` or one build id.
- CLAUDE_CODE_MAX_CONTEXT_TOKENS: The context window Claude Code should assume. It assumes 200,000 tokens for an id it does not recognize.

## Errors you may meet

- 401: The key is wrong, or it is in the variable the other header reads. Re-copy it from the console.
- A warning that the model is not recognized: Expected. Claude Code does not know the id and assumes a 200,000-token window; set `CLAUDE_CODE_MAX_CONTEXT_TOKENS` if the build’s window differs.
- 400 naming an unrecognized field: Claude Code’s docs give `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1` for endpoints that reject pre-release request fields.
- A startup warning about two credential sources: A saved login and the token are both present. The token is used; run `/logout` to clear the warning.
- 402: The prepaid balance is empty. Top up in the console.

## Why testers do this

Claude Code’s own docs say penetration testing and CTF workloads frequently trigger its model fallback. Pointing the agent at a security-tuned build keeps the tooling you know and changes the model’s willingness: these builds answer security questions other models decline. That is reduced refusals, not zero. The [page on Claude Code and security research](https://pentestllm.ai/claude-code-refuses-security-research) sets out the other options, including Anthropic’s own.

Use it only on systems you own or have written permission to test; the [acceptable use policy](https://pentestllm.ai/acceptable-use) applies to every request the agent sends. If you would sooner use an agent built for custom endpoints, see the [OpenCode guide](https://pentestllm.ai/agents/opencode).

## 9 security builds, priced per token

Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id `auto/security` has no price of its own: each request is billed at the build that answered.

| Build | Input | Output | Context |
| --- | --- | --- | --- |
| [Qwen3.8 27B Cybersecurity](https://pentestllm.ai/models/qwen3.8-27b-cybersecurity) | $0.40 | $2.40 | 262,144 |
| [Gemma 4 26B A4B Cybersecurity](https://pentestllm.ai/models/gemma-4-26b-a4b-it-cybersecurity) | $0.4224 | $1.3376 | 262,144 |
| [GLM-5.3 Flash Cybersecurity](https://pentestllm.ai/models/glm-5.3-flash-cybersecurity) | $0.5093 | $1.6975 | 1,048,576 |
| [Red Team (Flash)](https://pentestllm.ai/models/uplink-red-team-flash) | $0.90 | $3.00 | not published |
| [Red Team (Pro)](https://pentestllm.ai/models/uplink-red-team-pro) | $1.50 | $6.00 | not published |
| [OrcaCyber MiniMax M3.1 Flash](https://pentestllm.ai/models/minimax-m3.1-flash-cybersecurity) | $2.00 | $4.00 | 261,632 |
| [OrcaCyber Qwen3.8 Flash Next](https://pentestllm.ai/models/orcacyber-qwen3.8-flash-next) | $2.00 | $4.00 | 261,632 |
| [Cyber Frontier](https://pentestllm.ai/models/cyber-frontier) | $5.25 | $15.75 | 1,048,576 |
| [OrcaCyber Zero 1.5](https://pentestllm.ai/models/orca-zero-1.5-cybersecurity) | $7.50 | $18.75 | 999,488 |

[Full price list and tool fees](https://pentestllm.ai/pricing) · [Every model](https://pentestllm.ai/models) · [API docs](https://pentestllm.ai/docs)

## Questions

- It sends requests to whatever Anthropic-format endpoint ANTHROPIC_BASE_URL names, so yes in practice. Anthropic states that it does not support routing Claude Code to non-Claude models, so treat it as an unsupported setup.
- No. A local router was needed when an endpoint only spoke the OpenAI format. PentestLLM answers the Anthropic Messages format directly at https://api.pentestllm.ai/v1/messages.
- No. Set ANTHROPIC_BASE_URL to https://api.pentestllm.ai. Claude Code appends /v1/messages to it.
- Claude Code’s docs say that while a gateway credential variable is active, requests carry that credential in place of the subscription login. Requests to PentestLLM are billed per token to your PentestLLM balance.
- Use auto/security to let the router choose a security build per request, or a single build id from the models page to keep every turn on one model.

## Read next

- [All agent guides The same three values in every supported client.](https://pentestllm.ai/agents)
- [Claude Code and security research What to do when a coding agent declines authorized security work: change the model endpoint.](https://pentestllm.ai/claude-code-refuses-security-research)
- [OpenCode The opencode.json provider block for the security builds.](https://pentestllm.ai/agents/opencode)
- [Cline The OpenAI Compatible provider fields in Cline.](https://pentestllm.ai/agents/cline)
- [Kali MCP mcp-kali-server on Kali, driven by a security build through an MCP client.](https://pentestllm.ai/agents/kali-mcp)

Facts about other products and tools on this page were read from their own pages on 11 November 2026: [Claude Code docs: Connect to an LLM gateway](https://code.claude.com/docs/en/llm-gateway-connect), [Claude Code docs: Other LLM gateways](https://code.claude.com/docs/en/llm-gateway), [Claude Code docs: Gateway compatibility guide](https://code.claude.com/docs/en/llm-gateway-protocol), [Claude Code docs: Model configuration](https://code.claude.com/docs/en/model-config). They change; check the source before relying on a figure.

## One key, from $10

PentestLLM is for systems you own or have written permission to test. The [acceptable use policy](https://pentestllm.ai/acceptable-use) says what is not allowed.

[Get a key](https://app.pentestllm.ai/console)

usage, 1,000 agent turns on Qwen3.8 27B Cybersecurity

- Input, 8,000 tokens at $0.40 per million: $0.0032
- Output, 1,000 tokens at $2.40 per million: $0.0024
- One turn: $0.0056
- 1,000 turns: $5.60

output price per million tokens, 9 builds

$1.3376 Gemma 4 26B A4B Cybersecurity OrcaCyber Zero 1.5 $18.75