Prefer AnthropicConfig.fromValues, which validates the values and resolves contextWindow and reserveCompletion from the bundled model catalogue. The constructor is private: build one with the companion apply and adjust it with the with* setters. Java and Kotlin, which cannot see Scala default arguments, use AnthropicConfig.apply(apiKey, model) and the setters, so adding a field never breaks them.
Value parameters
apiKey
Anthropic API key; redacted in toString.
apiKeyProvider
asked for the key on every request instead of sending apiKey, so a rotated key is used without rebuilding the client (#2313): a section's apiKeyFile sets one. Never set together with workloadIdentity.
Model's total token capacity (prompt + completion combined).
model
Model identifier, e.g. "claude-sonnet-4-5-latest".
reserveCompletion
Tokens held back from prompt history for the completion.
timeouts
how long a request and a stream may take: the section's timeouts block. An absent value keeps the client's own default (ProviderTimeouts)
webSearch
whether the model may search the web: the section's webSearch key. When set, every request carries Anthropic's server-side web_search tool, and the sources the answer cites arrive on Completion.citations. Off by default; each search is billed by Anthropic.
workloadIdentity
workload identity federation instead of apiKey, which is then empty. The SDK posts the identity token to <baseUrl>/v1/oauth/token and the access token it gets back to every request, so baseUrl must be https://api.anthropic.com (plain http only to a loopback host, for tests). AnthropicConfig.fromValues checks this, and AnthropicClient refuses a config built any other way that breaks it.
The endpoint this config will contact, when it is known statically.
The endpoint this config will contact, when it is known statically.
Used by policy checks and diagnostics that need to know where traffic will go without knowing which provider it belongs to. None means the config carries no single URL — not that it makes no network calls.
The same config, its client asking provider for the key on each request, so a rotated key is used without rebuilding the client.
The same config, its client asking provider for the key on each request, so a rotated key is used without rebuilding the client.
The loader calls this for a section that sets apiKeyFile. The default returns this: a config whose client cannot take a provider ignores it, and its apiKeyProvider stays None - which the loader reports as an error for apiKeyFile and code setting a provider should check. A config that supports it overrides this with its own return type.
The same config with the given proxy and TLS settings.
The same config with the given proxy and TLS settings.
The loader calls this on every config a descriptor builds, as it does withTimeouts, so a descriptor does not read the http block itself. The default returns this: a config that does not carry the setting ignores it. A config that does overrides this with its own return type.
The loader calls this on every config a descriptor builds, passing the section's timeouts block, so a descriptor does not read the block itself. The default returns this: a config that does not carry timeouts, such as one supplied by another module, ignores them. A config that does overrides this with its own return type.