# Claude Code returns 403 — the fix checklist

> Markdown mirror of https://router.one/claude-code-403 for AI assistants and crawlers. Router One is an OpenAI-compatible LLM API gateway.
> Last updated: 2026-07-25

A 403 from Claude Code means a server received your request and refused it — which is actually good news, because the cause is almost always one of five local things: a missing environment variable, the wrong base URL, a stale login session, a disabled key, or a network path that the official endpoint refuses. Work through this checklist in order; each step takes under a minute.

## Step 1 — Set the base URL and the auth token

Claude Code authenticates against a third-party gateway with ANTHROPIC_AUTH_TOKEN, not ANTHROPIC_API_KEY. Setting only ANTHROPIC_API_KEY is the single most common cause of 403/401. ANTHROPIC_API_KEY is not required, and on current builds it triggers an extra approval prompt; if you set it earlier, unset it. Export these two, then restart the terminal so the session actually picks them up:

`claude-code-env.sh`

```bash
export ANTHROPIC_BASE_URL=https://api.router.one
export ANTHROPIC_AUTH_TOKEN=sk-your-router-one-key
unset ANTHROPIC_API_KEY
```

## Step 2 — Check the base URL, character by character

The Anthropic-compatible endpoint is https://api.router.one — no /v1 suffix. Appending /v1 (copied from OpenAI-style configs) produces requests against paths that don't exist on the Anthropic-compatible surface. If you previously pointed Claude Code at another relay, also check for a leftover ANTHROPIC_BASE_URL in ~/.zshrc, ~/.bashrc, or your shell profile that overrides the one you just set.

## Step 3 — Clear stale credentials

If you ever logged Claude Code into the official service on this machine, that stored session can take precedence over your environment variables — you think you're calling one endpoint while the tool authenticates against another. Sign out inside Claude Code (or remove its stored credentials), restart the terminal, and confirm the env vars are visible in the same session with `echo $ANTHROPIC_BASE_URL`.

## Step 4 — Verify the key itself

In Dashboard → API Keys, confirm the key is enabled and its spend cap (maxSpend) isn't exhausted — an exhausted or disabled key refuses requests regardless of your local config. Dashboard → Logs shows whether your requests are reaching the gateway at all: if nothing appears there, the failure is local (steps 1–3); if requests appear with 4xx codes, the trace tells you which limit you hit.

## The Mainland China case

Calling the official Anthropic endpoint directly from Mainland China commonly fails with 403 or connection errors because of regional restrictions on the provider side. Router One's gateway is reachable from Mainland China without a VPN, so the same two environment variables above are also the fix for the China-access case — there is no separate setup.

## FAQ

### Do I also need ANTHROPIC_API_KEY?

No. ANTHROPIC_AUTH_TOKEN is the variable Claude Code uses for a third-party gateway. ANTHROPIC_API_KEY is not required, and on current builds it triggers an extra approval prompt on launch; if you set it earlier, unset it in the same shell (and remove it from ~/.zshrc or ~/.bashrc). Router One's one-click installer writes only ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN into ~/.claude/settings.json.

### I set the variables but Claude Code still gets 403.

Print them in the same terminal session that launches Claude Code: echo $ANTHROPIC_BASE_URL. If it's empty, the export lives in a different shell or profile file. Also check for a stored official-service login that overrides env vars (step 3).

### Does the base URL end with /v1?

No — for Claude Code the Anthropic-compatible base URL is https://api.router.one without /v1. The /v1 suffix belongs to the OpenAI-compatible endpoint used by Codex CLI and OpenAI SDKs.

### How do I confirm requests are actually reaching the gateway?

Dashboard → Logs traces every request including failures. If your Claude Code attempts don't show up there at all, the request never left your machine correctly — go back to steps 1–3. If they show up with an error status, the trace points at the exact limit or key problem.

### Will this setup work from Mainland China?

Yes. The gateway is reachable from Mainland China without a VPN, and the configuration is identical to the global setup — the same two environment variables.

## See also

- Error codes reference: https://router.one/llm-api-error-codes#errors-in-claude-code
- Claude Code in China: https://router.one/claude-code-china
- Codex Responses API: https://router.one/codex-responses-api
- API authenticity check: https://router.one/llm-api-authenticity
- Region-block error fix: https://router.one/unsupported-country-region-territory
- insufficient_quota fix: https://router.one/openai-insufficient-quota
- CLI setup guide: https://router.one/docs/guides/cli-setup
- CC Switch guide: https://router.one/docs/guides/cc-switch
- Canonical page: https://router.one/claude-code-403
- Models and per-model token rates: https://router.one/models (markdown: https://router.one/models.md)
- Pricing: https://router.one/pricing
- API docs (markdown): https://router.one/docs.md
- Company facts: https://router.one/facts/company.md