Claude API version 2026-10-21 is the first since 2023, and the new SDKs send your key as a Bearer token

Anthropic released Claude API version 2026-10-21 on October 21. The versioning page lists only three versions in the API's history: 2023-01-01, 2023-06-01, and now 2026-10-21. The release notes pair it with new major versions of every client SDK and the ant CLI, and those carry breaking changes of their own that have nothing to do with the API version.

Three request shapes that now return a 400

The migration guide lists three Messages API changes, which also apply to token counting and to each request in a Message Batch:

• A document block placed directly in an assistant message is rejected. Documents nested inside another block, such as a web fetch result Claude returned, are still accepted.
• A text block with a non-empty citations array in a user message is rejected, including inside search_result blocks.
• temperature, top_p and top_k are gone. The guide is blunt: "In 2026-10-21, a request that sends temperature, top_p, or top_k returns a 400 error, even at the parameter's default value."

The third one is the change most code will hit. The guide spells out who loses something and who does not:

On models that accept other values, such as Claude Sonnet 4.6, a request that lowered temperature for more consistent output loses that effect. No other setting replaces it.

Anthropic, Migrating to API version 2026-10-21

For Claude 4.7 and later, which already accept only the defaults, the guide says they "sample as before." Its escape hatch for anyone who depends on a low temperature is to "keep that request on 2023-06-01." Neither the guide nor the versioning page, as read on October 23, gives an end date for 2023-06-01.

Admin API fields renamed

Responses from the Admin API and the Claude Enterprise Analytics API drop the old names of renamed fields: roles becomes role_ids, group_id becomes rbac_group_id, name on RBAC roles becomes display_name, group_type becomes group.type, and the analytics fields actor.email and summaries become actor.email_address and data.

The one with a semantic trap is workspace_id on API keys. Under 2023-06-01 it was null both for a key bound to the Default Workspace and for an all-workspaces key. Under 2026-10-21 it is replaced by scope, which carries the Default Workspace's real ID, while an all-workspaces key reports {"type": "organization"}. Code that treated null as "Default Workspace" needs to compare IDs instead.

The SDKs move your key to another header

The new versions are Python 2.0.0, TypeScript 1.0.0, C# 13.0.0, Go 2.0.0, Java 3.0.0, PHP 1.0.0, Ruby 2.0.0 and ant 2.0.0. The change most likely to break something outside your own code is authentication. In the guide's words, "The SDK and the CLI send your API key as Authorization: Bearer <key> instead of in the X-Api-Key header." It adds: "The Claude API accepts a key in either header."

# Before
X-Api-Key: <key>

# After
Authorization: Bearer <key>

So the API is fine; a gateway, log filter, middleware or test stub that reads X-Api-Key is not. There is a quieter failure too: in Python, TypeScript, Go and PHP, passing X-Api-Key as a per-request header to swap keys "no longer replaces the client's key: both keys go out." The Foundry clients are the exception and still send x-api-key.

The CLI drops --api-key and --auth-token outright, "because a value on the command line is visible in shell history and process listings." The replacements are the environment variables or --api-key-stdin. The Go SDK now requires Go 1.25 or later, and the legacy Text Completions API is removed from the TypeScript, Go, Java and Ruby SDKs and from the CLI.

Bedrock and the license

On Amazon Bedrock, 2026-10-21 "is available only for Claude 4.7 and later models." Callers of older Bedrock models are told to stay on their current SDK version. Separately, the new SDK and CLI versions are licensed under Apache 2.0; earlier versions remain under MIT. No code changes, but dependency license inventories need an update.

The guide's own ordering is worth following: upgrade the SDK and ship the fixes together, because the new SDK sends 2026-10-21 by default and the 400s arrive with it.

Primary sources: Migrating to API version 2026-10-21, API versions, Claude Platform release notes, read 2026-10-23.