Anthropic SDK for Python 2

Apply to the anthropic Python SDK 2.x and the SDK features used by this application. Apply the included Python baseline; the SDK's Python 3.10 minimum does not establish interpreter security support. Check beta interfaces against the installed SDK before using them. Do not assume a locked SDK minor receives a separate patch stream; review current upstream release notes when assessing fixes.

Client identity and outbound requests

• Construct Anthropic or AsyncAnthropic with a deliberate credential source. Explicit api_key, auth_token, credentials, config, and profile are mutually exclusive; environment static keys precede discovered profiles and workload identity, and ANTHROPIC_API_KEY wins over ANTHROPIC_AUTH_TOKEN when both are set. Remove unintended static credentials when federation or a token is intended. A credential passed to copy() or with_options() replaces the client's own, along with the base URL and headers its profile supplied; check the derived client's destination and identity.
• The client sends api_key as Authorization: Bearer, the same header as auth_token. Redact and read Authorization in log filters, middleware, proxies, gateways and test stubs, not only X-Api-Key. Setting X-Api-Key through extra_headers or default_headers does not replace the client's key, so both credentials go out; use with_options(api_key=...) or a separate client for a different key.
• Keep ANTHROPIC_CONFIG_DIR, profile files, credential files and identity-token files private and deployment-controlled. Never let a request select a