Does Claude Pro include an Anthropic API key?

No — it does not.

Claude Pro (the web subscription plan) gives you:

• Access to Claude models inside the Claude web app
• Higher usage limits than the free tier
• Priority access to newer models

Claude Pro does NOT include:

• An Anthropic API key
• API credits
• Programmatic access

Why are Claude Pro and the Anthropic API separate products?

This separation is standard across AI providers:

• ChatGPT Plus ≠ OpenAI API credits
• Claude Pro ≠ Anthropic API credits

The web subscription is a consumer SaaS product. The API is a developer infrastructure product with usage-based billing.

Why does Anthropic billing show “Buy Credits”?

That refers to API credits. It means you haven’t added billing funds for programmatic usage.

To use OpenClaw:

1. Create an API key at console.anthropic.com
2. Add billing / buy credits
3. Export your key in Ubuntu:

export ANTHROPIC_API_KEY="your_key_here"

• OS: Windows
• Tool: Strix (open‑source AI hacker)
• LLM Provider: Google Vertex AI
• Model: vertex_ai/gemini-2.5-pro
• Authentication: Google Cloud Application Default Credentials
• Target Application: Dummy web application

Prerequisites

Ensure the following are installed and running:

• Python
• Docker
• Google Cloud SDK
• LLM Provider Access

Authentication Notes

• No API key required
• Authentication handled via Google Cloud Application Default Credentials

Step 1: Install Strix

Since this setup uses Gemini models via Vertex AI, install Strix with Vertex support:

pipx install "strix-agent[vertex]"

If you plan to use OpenAI or Claude instead, install Strix without extras:

pipx install strix-agent

Step 2: Create or Select a Google Cloud Project

Vertex AI requires a Google Cloud project.

Option A: Use an Existing Project

If you already have projects in GCP:

gcloud projects list

Select one from the list.

Option B: Create a New Project (Recommended)

gcloud projects create my-strix-project
gcloud config set project my-strix-project

Step 3: Enable Vertex AI

Enable the Vertex AI API for the selected project:

gcloud services enable aiplatform.googleapis.com

Alternatively, enable it through the Google Cloud Console:

https://console.developers.google.com/apis/api/aiplatform.googleapis.com/overview?project=<your_project>

Enable Billing

Vertex AI requires billing to be enabled for the project:

https://console.developers.google.com/billing/enable?project=<yourproject>

Step 4: Configure Environment Variables

Set the required environment variables in Command Prompt (cmd.exe):

set STRIX_LLM=vertex_ai/gemini-2.5-pro
set VERTEXAI_PROJECT=my-strix-project
set VERTEXAI_LOCATION=us-central1

Step 5: Authenticate with Google Cloud

Authenticate using Application Default Credentials:

gcloud auth application-default login

This allows Strix to securely access Vertex AI without storing API keys.

How do you run Strix against a target application?

Run with Inline Instructions

strix --target https://dummy-app.example.com --instruction "perform authenticated testing using credentials: username:password"

Run with an Instruction File

strix --target https://dummy-app.example.com --instruction-file ./instructions_pentest.md

What does a Strix instruction file look like?

Below is a sample instructions_pentest.md file:

# Penetration Test Instructions

## Credentials
- Admin: admin_user / StrongPassword@123

## Focus Areas
1. Injection Attacks – SQL, NoSQL, command injection
2. Server-Side Issues – SSRF, XXE, deserialization flaws
3. Infrastructure – Misconfigurations, exposed services
4. Client-Side – XSS, prototype pollution, DOM vulnerabilities

## In Scope
/app-audit
/admin-console
/vendor-dashboard

## Out of Scope
- Third-party integrations

Why use Gemini 2.5 Pro for security scanning?

• Latest stable Pro‑grade Gemini model
• Deep reasoning and long‑context understanding
• Strong performance in code analysis and vulnerability discovery
• Ideal for security scanning where quality matters more than speed

Final Thoughts

Using Strix with Vertex AI Gemini 2.5 Pro provides a powerful, automated approach to penetration testing. By relying on Google Cloud’s authentication and managed AI infrastructure, you avoid API key management while benefiting from high‑quality security analysis.

Always ensure you have explicit authorization before running security scans against any application.

Disclaimer

This content is for educational and authorized security testing purposes only.

This new site is built with performance and aesthetics in mind, using a custom glassmorphism design system.

In this post, I explore how tools like Selenium and Playwright are being augmented by AI to self-heal and generate tests automatically.

• Battery drain analysis
• Bluetooth connectivity stability
• Sensor accuracy validation