If you use a provider factory, switching Claude platforms should be a deployment-config change: same container image, different environment. The catch is that each SDK client reads a different set of variables at construction time, some with strict failure behavior and some with quiet fallbacks. Here is the full map.
Per-client variable matrix
| Client | Variables read | Behavior when missing |
|---|---|---|
Anthropic() (1P) | ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, ANTHROPIC_PROFILE, WIF variables (ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID, ANTHROPIC_SERVICE_ACCOUNT_ID, ANTHROPIC_IDENTITY_TOKEN[_FILE]), ANTHROPIC_BASE_URL | Falls through a documented precedence chain, ending at on-disk profiles |
AnthropicAWS() | AWS_REGION (fallback AWS_DEFAULT_REGION), ANTHROPIC_AWS_WORKSPACE_ID, ANTHROPIC_AWS_API_KEY, plus the AWS credential chain (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, …) | Raises at construction if region or workspace ID is unresolved — no defaults |
AnthropicBedrockMantle(aws_region=...) | Standard AWS chain: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_REGION, then config files, SSO, roles, IMDS | Standard AWS credential resolution |
AnthropicVertex(project_id=..., region=...) | None specific to the client — project and region are constructor arguments; credentials come from Google Application Default Credentials resolution | ADC failure surfaces as a Google auth error |
AnthropicFoundry() | ANTHROPIC_FOUNDRY_API_KEY, ANTHROPIC_FOUNDRY_RESOURCE, ANTHROPIC_FOUNDRY_BASE_URL | resource and base_url are mutually exclusive; set one |
The traps worth knowing
Empty strings still win. On the first-party chain, a credential variable set to an empty string still occupies its precedence slot: ANTHROPIC_API_KEY="" selects the API-key path with an empty key and shadows federation and profiles entirely. Unset unused variables; don't blank them.
Two different workspace variables exist. ANTHROPIC_AWS_WORKSPACE_ID configures Claude Platform on AWS. The similarly named ANTHROPIC_WORKSPACE_ID is a different, first-party variable that scopes Workload Identity Federation tokens. Mixing them up produces confusing auth failures on both sides.
Region strictness differs between the two AWS clients. AnthropicAWS errors out with no region; the legacy AnthropicBedrock client quietly defaults to us-east-1 and does not read ~/.aws/config for the region. If a Bedrock workload seems to be running in the wrong region, this default is the first suspect.
Vertex is configured in code, not env. AnthropicVertex takes project_id and region as constructor arguments, so a twelve-factor setup should pass its own variables (e.g. GCP_PROJECT_ID, VERTEX_REGION) through the factory explicitly rather than expecting the SDK to find them.
A portable twelve-factor layout
One selector variable plus one namespaced block per platform. Only the selector and the active block need to be present in any given deployment:
# selector
CLAUDE_PLATFORM=bedrock # 1p | aws | bedrock | vertex | foundry
# 1p
ANTHROPIC_API_KEY=sk-ant-api...
# aws (Claude Platform on AWS)
AWS_REGION=us-west-2
ANTHROPIC_AWS_WORKSPACE_ID=wrkspc_01AbCdEf23GhIj
# bedrock — AWS credential chain (role, SSO, or keys) + AWS_REGION
# vertex — ADC on the runtime, plus:
GCP_PROJECT_ID=my-project
VERTEX_REGION=global
# foundry
ANTHROPIC_FOUNDRY_API_KEY=...
ANTHROPIC_FOUNDRY_RESOURCE=example-resourceKeep secrets in your secret manager and inject them as env at deploy time; keep the non-secret values (region, workspace ID, resource name, project ID) in per-environment config. Because every platform-specific value now lives in the environment, promoting the same build from a Vertex staging environment to a Bedrock production environment is a config diff, not a code change.
AnthropicAWS already fails fast on missing config; give the other platforms the same courtesy with your own checks rather than discovering a missing variable on the first live request.Where to go next
See the auth mechanisms comparison for what these credentials actually do on the wire, and SDK environment variables for the single-platform basics.