Claude API · fixes · 2026-10-24

Anthropic API 2026-10-21 broke my code: the fixes

You ran pip install -U anthropic or bumped @anthropic-ai/sdk, and now requests fail with a 400 about sampling parameters, or your proxy or gateway starts rejecting them. The likely cause is API version 2026-10-21, which the new SDK major versions send by default. This post covers the two breaks we expect most people to hit first: temperature, top_p, and top_k, and API keys moving from X-Api-Key to Authorization: Bearer.

If you want the next step, read Claude ‘temperature is deprecated for this model’: the 400 error and the fix in Next.js.

What we did and didn't test. We don't have an Anthropic API key and made no live API calls, so we haven't seen these errors ourselves. Everything about what the API and SDKs do is quoted from Anthropic's docs and changelog as of 24 Oct 2026 (listed in Sources), plus public GitHub issues where noted. Anthropic does not print the 400 response body for the sampling change, so we don't show one. Check the docs before you rely on a detail here.

Quick fix: what to do right now

1. Remove `temperature`, `top_p`, and `top_k`

Anthropic's migration guide says: "In 2026-10-21, a request that sends temperature, top_p, or top_k returns a 400 error, even at the parameter's default value." Its instruction is: "Remove the three parameters from your requests."

For the model-level rules on 2023-06-01, and a Next.js helper that removes these parameters, see our temperature 400 fix.

2. Make your proxy read `Authorization`, or send `X-Api-Key` yourself

The guide says: "The SDK and the CLI send your API key as Authorization: Bearer instead of in the X-Api-Key header, so change any proxy or gateway that reads or sets X-Api-Key to use Authorization, or send the key in X-Api-Key yourself." It also says: "The Claude API accepts a key in either header."

3. Or stay on the old version until you’re ready

The guide says: "If you use an SDK, your requests use the API version that was current when your SDK's major version was released." So pinning your SDK below the new major keeps your requests on 2023-06-01. For the sampling parameters in particular, the guide says that if a request relies on a non-default value, "either stop sending the parameter, or keep that request on 2023-06-01."

How to tell which version you’re on

The 21 Oct 2026 release notes list the first versions that send 2026-10-21 by default: "Python SDK 2.0.0, TypeScript SDK 1.0.0, C# SDK 13.0.0, Go SDK 2.0.0, Java SDK 3.0.0, PHP SDK 1.0.0, Ruby SDK 2.0.0, and ant CLI 2.0.0."

How to tell which version you're on
SDK	First version on `2026-10-21`
Python (`anthropic`)	2.0.0
TypeScript (`@anthropic-ai/sdk`)	1.0.0
C# (`Anthropic`)	13.0.0
Go (`anthropic-sdk-go/v2`)	2.0.0
Java (`anthropic-java`)	3.0.0
PHP (`anthropic-ai/sdk`)	1.0.0
Ruby (`anthropic`)	2.0.0
`ant` CLI	2.0.0

If you call the API without an SDK, you choose the version yourself with the anthropic-version header. The guide's cURL example sends anthropic-version: 2026-10-21.

If your dependency range is unpinned, such as "*" or latest, a fresh install can pull the new major. Check your lockfile for the version you actually have.

Sampling parameters: why even `temperature: 1` now fails

On 2023-06-01, newer models already rejected non-default values but accepted the defaults. On 2026-10-21 the rule moves from the model to the API version. The versioning page says: "The temperature, top_p, and top_k request parameters are removed. A request that sends any of them returns a 400 error on every model."

The guide also says: "As of the latest major versions, the SDK and the CLI no longer have the three parameters." So code that still sets them may also fail type checks after the upgrade.

If you lowered temperature for steadier output on an older model, the guide is clear about what you lose: "On models that accept other values, such as Claude Sonnet 4.6, a request that lowered temperature for more consistent output loses that effect. No other setting replaces it. If a request relies on a non-default value, either stop sending the parameter, or keep that request on 2023-06-01."

`Authorization: Bearer` and proxies, gateways, and middleware

What breaks

Anything that expects the key in X-Api-Key. The guide lists the places to check: "Also change code in your own program that reads X-Api-Key, such as middleware, a log filter, or a test stub."

One public example: the Portunus issue #215 (opened 24 Oct 2026) reports that a proxy configured to read x-api-key "rejects clients on anthropic 2.x". What your users see depends on your proxy, so the error text varies. Searches for "anthropic invalid x api key" suggest some people may see an invalid key message.

Fix in the proxy

If you control the proxy, have it read the key from Authorization (stripping the Bearer prefix). If you have clients on both old and new SDKs, it may need to accept either header for a while.

Fix in the client

These snippets are from the migration guide. We haven't run them against the API.

TypeScript: "Set the header yourself. Authorization: null stops the key from going out there as well:"

const client = new Anthropic({
  apiKey,
  defaultHeaders: { "X-Api-Key": apiKey, Authorization: null }
});

Python: "Move the key back with an auth function on the HTTP client. It runs on every request the client sends, including retries:"

import httpx2
from anthropic import Anthropic, DefaultHttpxClient

def send_x_api_key(request: httpx2.Request) -> httpx2.Request:
    if request.headers.get("Authorization") == f"Bearer {api_key}":
        del request.headers["Authorization"]
        request.headers["X-Api-Key"] = api_key
    return request

client = Anthropic(api_key=api_key, http_client=DefaultHttpxClient(auth=send_x_api_key))

The guide has the equivalent for C#, Go, Java, PHP, and Ruby. For the ant CLI it says: "ant has no flag or environment variable for adding a header of your own, so it can't send X-Api-Key." There, the proxy has to change.

Foundry and Bedrock

Not every client moved. For TypeScript, the guide says "apiKey in @anthropic-ai/foundry-sdk still goes out as X-Api-Key", and for Python, "AnthropicFoundry still sends its key as x-api-key".

On Bedrock, the guide says: "On Amazon Bedrock, 2026-10-21 is available only for Claude 4.7 and later models." An open issue, anthropic-sdk-python #2031, reports this 400 from AnthropicBedrock 2.x on older models such as Claude Sonnet 4.5:

anthropic.BadRequestError: Error code: 400 - {'message': 'Invalid API version: 2026-10-21'}

The reporter's workaround is to pass extra_body={"anthropic_version": "bedrock-2023-05-31"}. That's a user report, not official guidance, so check the issue for updates first.

One credential per client

The guide says: "An API key and an authentication token now share a header, so an SDK client holds one credential." Passing both now fails: in Python, two credentials "raise ValueError", and in TypeScript they "throw a TypeError". In PHP the documented message is:

Pass at most one of `apiKey`, `authToken`, or `credentials`. Received `apiKey`, `authToken`.

If both environment variables are set and you pass none in code, PHP and Ruby print this warning:

Anthropic: ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN are both set. Using ANTHROPIC_API_KEY.

If you sent a gateway token and an API key together, the guide's pattern is to keep the token as the auth token and set X-Api-Key in the default headers, then: "Have the gateway remove its Authorization header before it forwards the request. The Claude API expects one credential for each request."

Other breaks you may hit

The guide lists more. A few that are easy to miss:

MessageParam in Python. "Calling either name now raises a TypeError". Write messages as dicts instead.
Document blocks in assistant messages. "a request that places a document block directly in an assistant message returns a 400 error."
Citations in user messages. "a request that sends a text block with a non-empty citations array in a user message returns a 400 error."
ant --api-key. The flag is removed. "A command that still passes one stops with flag provided but not defined."

Checklist before you upgrade

Pin your SDK major version in your lockfile until you've tested.
Search your code for temperature, top_p, and top_k, and for X-Api-Key in proxies, middleware, log filters, and test stubs.
Check that each client is given one credential.
The guide says: "Test your integration against 2026-10-21 before you release." Run your CI against the new version too.

Anthropic's release notes also mention a free Claude API skill for Claude Code. Check its docs to see whether it covers this upgrade for you.

FAQ

Is 2023-06-01 going away? The versioning page still lists it, and the guide tells you to keep a request on it if you rely on a non-default temperature. We found no retirement date for it in the pages we checked on 24 Oct 2026.

Why does temperature: 1 return a 400 now? On 2026-10-21 the parameter is removed, so sending it at any value is rejected, "even at the parameter's default value."

Can I keep using a custom temperature? Only by keeping that request on 2023-06-01, per the guide, and only on models that accept other values.

Does the Claude API still accept x-api-key? Yes. The guide says: "The Claude API accepts a key in either header." What changed is what the SDKs send.

Why did my proxy start rejecting requests after an SDK upgrade? It probably reads X-Api-Key, and the new SDK sends the key in Authorization: Bearer. Change the proxy or set the header yourself, as above.

Can I set both an API key and an auth token? Not on one client in the new majors. Pick one, or use the gateway pattern above.

For other Claude API errors, see our 429 rate limit error guide.

Disclosure: this is our own paid product.

Claude API 2026-10-21 Upgrade Kit · code and proxy checks

Find what else 2026-10-21 touches in your code

The fixes above cover the two breaks we expect most people to hit first. To check the rest of your codebase, this kit has a scanner designed to flag code and proxy settings that break on API version 2026-10-21, such as temperature, top_p or top_k in requests and a proxy that only reads X-Api-Key. Each finding links to Anthropic's migration guide. You run it locally or in a GitHub Actions step, and it comes with proxy snippets for the switch to Authorization: Bearer and a rules block designed to help stop coding agents re-adding removed parameters. It doesn't rewrite your code or call the API, and being pattern-based, it can miss requests built dynamically.

$9 (plus VAT where applicable)

See what's in the Claude API 2026-10-21 Upgrade Kit

Anthropic and Claude are trademarks of Anthropic. GitHub is a trademark of GitHub, Inc. Other names belong to their owners. Names are used only to identify products and compatibility. Stack & Ship is not affiliated with or endorsed by any of them.

Sources (checked 24 October 2026):

Anthropic, Claude, and Claude Code are trademarks of Anthropic. Cursor is a trademark of Anysphere Inc. Amazon Bedrock is a trademark of Amazon.com, Inc. or its affiliates. Microsoft Foundry and TypeScript are trademarks of Microsoft. Next.js is a trademark of Vercel Inc. Supabase is a trademark of Supabase Inc. Stripe is a trademark of Stripe, Inc. GitHub is a trademark of GitHub, Inc. Python is a trademark of the Python Software Foundation. Java is a trademark of Oracle and/or its affiliates. Go is a trademark of Google LLC. PHP is a trademark of The PHP Group. Other names belong to their owners. Names are used only to identify products and compatibility. Stack & Ship is not affiliated with or endorsed by any of them.