# Sivanandam S — full content > ISTQB certified test analyst writing about software testing, test automation and AI security. Source: https://www.sivanandam.in · Generated 2026-09-04 · 5 articles Author: Sivanandam S — ISTQB certified test analyst with over 15 years of experience testing web, mobile, OTT, chatbot and smart wearable applications, and building dedicated testing services for teams across multiple locations. Contact: siva@hey.com · https://x.com/sivanandams · https://github.com/sivanandams · https://instagram.com/sivanandams --- # Claude Pro vs Anthropic API & OpenClaw Usage Cost > Claude Pro and the Anthropic API are separate products: a Claude Pro subscription does not include an API key, API credits, or programmatic access. To run OpenClaw you need your own key from console.anthropic.com with billing enabled, which typically costs $20-$60 per month for light personal use and $75-$250 for daily automation work. - **Author:** Sivanandam S (https://www.sivanandam.in/) - **Published:** 2026-02-18 - **Updated:** 2026-02-18 - **Section:** AI Tooling - **Tags:** Claude Pro, Anthropic API, OpenClaw, AI cost - **Canonical URL:** https://www.sivanandam.in/blog/claude-pro-vs-anthropic-api-cost/ ## Key takeaways - Claude Pro covers the Claude web app only - it includes no Anthropic API key and no API credits. - OpenClaw requires an API key created at console.anthropic.com, with billing funds added separately. - The "Buy Credits" prompt in Anthropic billing refers to API credits, not to a Claude Pro subscription. - Light OpenClaw usage of 20-40 prompts a day costs roughly $20-$60 per month; moderate daily automation work costs $75-$250. - Most automation engineers using Sonnet-class models for Playwright work land between $50 and $150 per month. ## Does Claude Pro include an Anthropic API key? **No — it does not.** Claude Pro (the web subscription plan) gives you: - Access to Claude models inside the Claude web app - Higher usage limits than the free tier - Priority access to newer models Claude Pro **does NOT include:** - An Anthropic API key - API credits - Programmatic access > OpenClaw requires an Anthropic API key from the developer console (console.anthropic.com). Claude Pro ≠ API access. ### Why are Claude Pro and the Anthropic API separate products? This separation is standard across AI providers: - ChatGPT Plus ≠ OpenAI API credits - Claude Pro ≠ Anthropic API credits The web subscription is a consumer SaaS product. The API is a developer infrastructure product with usage-based billing. ### Why does Anthropic billing show “Buy Credits”? That refers to API credits. It means you haven’t added billing funds for programmatic usage. **Claude Pro subscription compared with Anthropic API access** | Product | Includes API key? | Used for | | --- | --- | --- | | Claude Pro | ❌ No | Web chat only | | Anthropic API | ✅ Yes (after billing) | OpenClaw, scripts, automation | **To use OpenClaw:** 1. Create an API key at console.anthropic.com 2. Add billing / buy credits 3. Export your key in Ubuntu: `export ANTHROPIC_API_KEY="your_key_here"` ## How much does OpenClaw cost per month? Cost depends on: - Model used (Sonnet vs higher-tier) - Project size - Daily usage frequency - Iteration loops - Context size sent repeatedly ### Light usage: personal development - 20–40 prompts per day - Small repository - Short edits **Estimated Monthly Cost:** $20 – $60 ### Moderate usage: daily automation work - 50–100 prompts per day - Medium-sized repo - Frequent refactoring + debugging **Estimated Monthly Cost:** $75 – $250 ### Heavy usage: enterprise and large codebases - Large repository context - Long reasoning loops - Continuous generation **Estimated Monthly Cost:** $300 – $1,200+ > Most automation engineers using Sonnet-class models for Playwright/POM development fall in the $50 – $150 per month range. ### How can you reduce OpenClaw costs? - Use Sonnet instead of higher-tier models unless necessary - Keep prompts precise - Avoid sending entire repository repeatedly - Clear conversation context when switching tasks - Avoid unnecessary regeneration loops ## Frequently asked questions ### Does a Claude Pro subscription include an Anthropic API key? No. Claude Pro gives access to Claude models inside the web app, higher usage limits than the free tier, and priority access to newer models. It includes no API key, no API credits and no programmatic access. API access is billed separately through console.anthropic.com. ### How much does OpenClaw cost per month? Light personal development of 20-40 prompts a day on a small repository costs roughly $20-$60 per month. Moderate daily automation work at 50-100 prompts a day runs $75-$250. Heavy enterprise usage on large codebases can reach $300-$1,200 or more. ### Why does Anthropic billing ask me to buy credits if I already pay for Claude Pro? Those are API credits, which fund programmatic usage. Claude Pro is a consumer subscription for the web app, while the API is a separate developer product with usage-based billing. The same split applies to ChatGPT Plus and the OpenAI API. ### How can I reduce my OpenClaw API costs? Use Sonnet-class models unless a higher tier is genuinely needed, keep prompts precise, avoid resending the entire repository on every request, clear conversation context when switching tasks, and avoid unnecessary regeneration loops. ### What do I need to start using OpenClaw? Create an API key at console.anthropic.com, add billing or buy credits, then export the key in your shell as ANTHROPIC_API_KEY before running OpenClaw. --- Written by Sivanandam S. ISTQB certified test analyst with over 15 years of experience testing web, mobile, OTT, chatbot and smart wearable applications, and building dedicated testing services for teams across multiple locations. --- # Using Strix Open‑Source AI Hacker for Automated Penetration Testing (Windows) > Strix is an open-source AI hacker that automates penetration testing with large language models. On Windows, install it with pipx install "strix-agent[vertex]", enable Vertex AI on a billed Google Cloud project, set the STRIX_LLM, VERTEXAI_PROJECT and VERTEXAI_LOCATION environment variables, authenticate with gcloud auth application-default login instead of an API key, then run it against a target you are authorized to test. - **Author:** Sivanandam S (https://www.sivanandam.in/) - **Published:** 2026-01-13 - **Updated:** 2026-01-13 - **Section:** Security Testing - **Tags:** Strix, penetration testing, AI security, Vertex AI, Gemini 2.5 Pro, Windows - **Canonical URL:** https://www.sivanandam.in/blog/using-strix-ai-hacker-automated-pentesting-windows/ ## Key takeaways - Strix runs on Windows through pipx; the [vertex] extra adds Google Vertex AI support. - Vertex AI needs a Google Cloud project with aiplatform.googleapis.com enabled and billing active. - Authentication uses Google Cloud Application Default Credentials, so no API key is stored on disk. - Three environment variables configure the model: STRIX_LLM, VERTEXAI_PROJECT and VERTEXAI_LOCATION. - Gemini 2.5 Pro suits security scanning because long-context reasoning and code analysis matter more than speed. - Only scan applications you have explicit authorization to test. ## Overview - **OS:** Windows - **Tool:** Strix (open‑source AI hacker) - **LLM Provider:** Google Vertex AI - **Model:** `vertex_ai/gemini-2.5-pro` - **Authentication:** Google Cloud Application Default Credentials - **Target Application:** Dummy web application ## Prerequisites Ensure the following are installed and running: - Python - Docker - Google Cloud SDK - LLM Provider Access ### Authentication Notes - No API key required - Authentication handled via Google Cloud Application Default Credentials ## Step 1: Install Strix Since this setup uses Gemini models via Vertex AI, install Strix with Vertex support: ``` pipx install "strix-agent[vertex]" ``` If you plan to use OpenAI or Claude instead, install Strix without extras: ``` pipx install strix-agent ``` ## Step 2: Create or Select a Google Cloud Project Vertex AI requires a Google Cloud project. ### Option A: Use an Existing Project If you already have projects in GCP: ``` gcloud projects list ``` Select one from the list. ### Option B: Create a New Project (Recommended) ``` gcloud projects create my-strix-project gcloud config set project my-strix-project ``` ## Step 3: Enable Vertex AI Enable the Vertex AI API for the selected project: ``` gcloud services enable aiplatform.googleapis.com ``` Alternatively, enable it through the Google Cloud Console: ``` https://console.developers.google.com/apis/api/aiplatform.googleapis.com/overview?project= ``` ### Enable Billing Vertex AI requires billing to be enabled for the project: ``` https://console.developers.google.com/billing/enable?project= ``` ## Step 4: Configure Environment Variables Set the required environment variables in Command Prompt (`cmd.exe`): ``` set STRIX_LLM=vertex_ai/gemini-2.5-pro set VERTEXAI_PROJECT=my-strix-project set VERTEXAI_LOCATION=us-central1 ``` ## Step 5: Authenticate with Google Cloud Authenticate using Application Default Credentials: ``` gcloud auth application-default login ``` This allows Strix to securely access Vertex AI without storing API keys. ## How do you run Strix against a target application? ### Run with Inline Instructions ``` strix --target https://dummy-app.example.com --instruction "perform authenticated testing using credentials: username:password" ``` ### Run with an Instruction File ``` strix --target https://dummy-app.example.com --instruction-file ./instructions_pentest.md ``` ## What does a Strix instruction file look like? Below is a sample `instructions_pentest.md` file: ``` # Penetration Test Instructions ## Credentials - Admin: admin_user / StrongPassword@123 ## Focus Areas 1. Injection Attacks – SQL, NoSQL, command injection 2. Server-Side Issues – SSRF, XXE, deserialization flaws 3. Infrastructure – Misconfigurations, exposed services 4. Client-Side – XSS, prototype pollution, DOM vulnerabilities ## In Scope /app-audit /admin-console /vendor-dashboard ## Out of Scope - Third-party integrations ``` ## Why use Gemini 2.5 Pro for security scanning? - Latest stable Pro‑grade Gemini model - Deep reasoning and long‑context understanding - Strong performance in code analysis and vulnerability discovery - Ideal for security scanning where quality matters more than speed ## Final Thoughts Using Strix with Vertex AI Gemini 2.5 Pro provides a powerful, automated approach to penetration testing. By relying on Google Cloud’s authentication and managed AI infrastructure, you avoid API key management while benefiting from high‑quality security analysis. Always ensure you have explicit authorization before running security scans against any application. ### Disclaimer This content is for educational and authorized security testing purposes only. ## Frequently asked questions ### How do I install Strix on Windows? Install it with pipx. Use pipx install "strix-agent[vertex]" for Google Vertex AI support, or pipx install strix-agent if you plan to use OpenAI or Claude models instead. Python, Docker and the Google Cloud SDK must be installed and running first. ### Does Strix need an API key to use Gemini 2.5 Pro? No. With Vertex AI, Strix authenticates through Google Cloud Application Default Credentials. Run gcloud auth application-default login once and Strix reaches the model without any API key stored on your machine. ### Which environment variables does Strix need for Vertex AI? Three: STRIX_LLM set to vertex_ai/gemini-2.5-pro, VERTEXAI_PROJECT set to your Google Cloud project ID, and VERTEXAI_LOCATION set to a region such as us-central1. ### How do I give Strix detailed penetration testing instructions? Pass a markdown instruction file with strix --target --instruction-file ./instructions_pentest.md. The file can list credentials, focus areas such as injection and SSRF, and explicit in-scope and out-of-scope paths. ### Why use Gemini 2.5 Pro for automated security testing? It is a Pro-grade model with deep reasoning and long-context understanding, and it performs well on code analysis and vulnerability discovery - qualities that matter more than raw speed for security scanning. --- Written by Sivanandam S. ISTQB certified test analyst with over 15 years of experience testing web, mobile, OTT, chatbot and smart wearable applications, and building dedicated testing services for teams across multiple locations. --- # Welcome to My New Digital Home > I've decided to revamp my personal website to better reflect my journey in the digital realm. Here's a look at the new design philosophy. - **Author:** Sivanandam S (https://www.sivanandam.in/) - **Published:** 2026-01-12 - **Updated:** 2026-01-12 - **Section:** Notes - **Tags:** personal site, web design - **Canonical URL:** https://www.sivanandam.in/blog/welcome-to-my-new-digital-home/ Welcome! After years of using standard templates, I decided it was time for a refresh. Use this space to share your thoughts, updates, and more. This new site is built with performance and aesthetics in mind, using a custom glassmorphism design system. --- Written by Sivanandam S. ISTQB certified test analyst with over 15 years of experience testing web, mobile, OTT, chatbot and smart wearable applications, and building dedicated testing services for teams across multiple locations. --- # The Future of Test Automation > Exploring how AI agents and LLMs are revolutionizing the way we approach QA and test automation. - **Author:** Sivanandam S (https://www.sivanandam.in/) - **Published:** 2025-12-28 - **Updated:** 2025-12-28 - **Section:** Test Automation - **Tags:** test automation, AI agents, Playwright, Selenium - **Canonical URL:** https://www.sivanandam.in/blog/future-of-test-automation-ai-agents/ Test automation is evolving rapidly. With the advent of advanced AI agents, we are moving from script-based testing to intent-based testing. In this post, I explore how tools like Selenium and Playwright are being augmented by AI to self-heal and generate tests automatically. --- Written by Sivanandam S. ISTQB certified test analyst with over 15 years of experience testing web, mobile, OTT, chatbot and smart wearable applications, and building dedicated testing services for teams across multiple locations. --- # Exploring Smart Wearables QA > Testing wearables presents unique challenges compared to traditional mobile apps. From battery usage to sensor data validation. - **Author:** Sivanandam S (https://www.sivanandam.in/) - **Published:** 2025-11-15 - **Updated:** 2025-11-15 - **Section:** Quality Engineering - **Tags:** smart wearables, QA, Bluetooth, sensor testing - **Canonical URL:** https://www.sivanandam.in/blog/exploring-smart-wearables-qa/ Smart wearables are becoming ubiquitous. Testing them requires a different mindset. You aren't just testing a screen; you're testing an ecosystem. - Battery drain analysis - Bluetooth connectivity stability - Sensor accuracy validation --- Written by Sivanandam S. ISTQB certified test analyst with over 15 years of experience testing web, mobile, OTT, chatbot and smart wearable applications, and building dedicated testing services for teams across multiple locations.