Claude Platform: Workload Identity Federation Is GA and the June 15 Agent SDK Billing Split Was Rolled Back

TL;DR: Workload Identity Federation is GA on the Claude Platform — no more static API keys — and the June 15 Agent SDK billing split was rolled back before it took effect.

Workload Identity Federation (WIF) is now generally available as of June 17. Instead of embedding a static Anthropic API key in your CI config or secrets manager, workloads authenticate with the identity they already have: an AWS IAM role, a GCP service account, a GitHub Actions OIDC token, an Azure managed identity, or any OIDC-compliant provider. The Claude Platform verifies the signed OIDC token, matches its claims against federation rules, and issues a short-lived scoped credential. No key to rotate, no key that retains full access if it leaks from a log or env dump. Each workload gets its own service account with an independent audit trail — useful when you have multiple agents hitting the API for different purposes and need to attribute costs and audit requests separately.

Setup is a guided flow in the Claude Console. Per-provider docs are at platform.claude.com/docs/en/manage-claude/workload-identity-federation. GitHub Actions is the fastest first integration — your GITHUB_TOKEN becomes your API credential with no secret storage.

The June 15 Agent SDK billing change was paused — on the same day it was due to take effect. The original plan (announced May 14): move claude -p, Agent SDK calls, Claude Code GitHub Actions, and third-party agent usage off your subscription limit onto a separate monthly credit pool ($20/Pro · $100/Max 5x · $200/Max 20x) at full API rates. That plan is suspended. Those surfaces continue drawing from your existing plan limits exactly as before. Anthropic says it is reworking the model and will give advance notice before any future change takes effect.

Sources: Workload Identity Federation — Anthropic blog, WIF docs, Agent SDK billing — Claude Help Center