# Claude Code GitHub Actions: run it in CI with an API key

> How to run Claude Code in GitHub Actions with one workflow file, where the API key goes, and what each run costs on a 5abeer key.

Updated: 2026-11-01

Claude Code GitHub Actions runs Claude Code inside your repository's workflows. Mention `@claude` in an issue or pull request and Claude answers, reviews or pushes a fix. Give it a prompt instead and it runs on every pull request or on a schedule. On a 5abeer key, you add one secret and one base URL line.

## What is Claude Code GitHub Actions?

Anthropic describes it as "a GitHub Action that runs Claude Code inside your repository's workflows." It is the `anthropics/claude-code-action` step, built on the Claude Agent SDK. On a GitHub runner, Claude reads your repository, runs the commands you allow, comments on issues and pull requests, and pushes commits.

The action picks its mode from your workflow:

- **Interactive mode:** with no `prompt` input, Claude waits for `@claude` in a comment, a review, or the title or body of a new issue, and replies in a comment that it updates as it works.
- **Automation mode:** with a `prompt` input, Claude runs on the event itself, such as a new pull request or a schedule. Results go to the workflow run log unless the prompt tells Claude to post them.

## How do you add it to a repository?

Both paths need admin access to the repository:

- **Quick setup:** run `/install-github-app` in `claude` inside the repository. It needs the GitHub CLI signed in with `gh auth login` and works only with github.com. It installs the Claude GitHub App, saves an API key or token as a repository secret, pushes a branch with the workflow and opens GitHub's pull request page in your browser, where you create and merge it.
- **Manual setup:** install the [Claude GitHub App](https://github.com/apps/claude), add the secret yourself, and copy `examples/claude.yml` from the action's repository into `.github/workflows/`.

Quick setup's workflow has no base URL line, so it calls Anthropic's API. If you used quick setup, put your 5abeer key in the secret and add the `env` lines below. The action uses three of the app's permissions, all read and write: Contents, Issues and Pull requests. Installing the app still grants its full permission set, including write access to Actions and Workflows, because GitHub doesn't let you accept a subset. To grant only these three, create your own GitHub App as in the action's setup guide.

## What goes in the workflow file?

This workflow answers `@claude` in issue and pull request comments, on a 5abeer key:

```yaml
name: Claude Code
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
env:
  ANTHROPIC_BASE_URL: https://api.5abeer.ai
jobs:
  claude:
    if: contains(github.event.comment.body, '@claude')
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: write
      pull-requests: write
      issues: write
      id-token: write
      actions: read
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          claude_args: "--model claude-sonnet-5.5 --max-turns 10"
```

The lines that matter:

- **`ANTHROPIC_BASE_URL`:** sends Claude Code's requests to 5abeer. Write it without `/v1`.
- **`anthropic_api_key`:** reads your 5abeer key from the `ANTHROPIC_API_KEY` secret, so the key never appears in the file.
- **`claude_args`:** passes Claude Code CLI arguments. `--model` picks a model your key serves, and `--max-turns` caps the work in one run.
- **`id-token: write` and `actions: read`:** the first is required for the action's default GitHub App authentication. The second lets Claude read CI results.
- **`if` and `timeout-minutes`:** the job starts only on comments that mention `@claude`, and stops after 30 minutes if stuck.

Commit the file, then comment `@claude explain what this pull request changes` on a pull request.

## How do you keep the key secret?

Anthropic's docs are direct: "Never commit API keys or OAuth tokens directly to your repository." Store the key as a GitHub secret:

- **Add the secret:** in the repository, open Settings, then Secrets and variables, then Actions, and choose New repository secret. Name it `ANTHROPIC_API_KEY` and paste your 5abeer key as the value.
- **Share it across repositories:** store it once as an organization-level Actions secret.
- **Retire it in two places:** deleting the GitHub secret leaves the key itself valid. Delete the key in [your 5abeer keys](https://5abeer.ai/en/docs/start/keys.md) too.
- **Grant only what the job needs:** keep the `permissions` block minimal and review Claude's changes before you merge.

The action also checks who triggered it: on issue and pull request events, the user needs write access, and bots are rejected unless listed in `allowed_bots`. The base URL isn't secret, so it stays in the file.

## How to run it on a 5abeer key

### 1. Top up your balance

Pay with one of the [payment methods](https://5abeer.ai/en/docs/start/payment.md). Every workflow run's requests are deducted from this balance.

### 2. Create a key for CI

Create a key for the Anthropic provider, as in [Create a key](https://5abeer.ai/en/docs/start/keys.md#create). Name it `github-actions` and give it a spend limit, as in [Control every key](https://5abeer.ai/en/docs/start/keys.md#controls).

### 3. Test the key

Send one request from your machine before you save the key in GitHub. A reply means the key and base URL work:

```bash
curl --request POST "https://api.5abeer.ai/v1/messages" \
  --header "x-api-key: $KHABEER_API_KEY" \
  --header "Content-Type: application/json" \
  --header "anthropic-version: 2023-06-01" \
  --data '{"model":"claude-sonnet-5.5","max_tokens":512,"messages":[{"role":"user","content":"Write a product idea in one sentence."}]}'
```

```python
import os
import requests

response = requests.post(
    "https://api.5abeer.ai/v1/messages",
    headers={
        "x-api-key": os.environ['KHABEER_API_KEY'],
        "Content-Type": "application/json",
        "anthropic-version": "2023-06-01",
    },
    json={
    "model": "claude-sonnet-5.5",
    "max_tokens": 512,
    "messages": [
        {
            "role": "user",
            "content": "Write a product idea in one sentence."
        }
    ]
},
    stream=False,
    timeout=60,
)

response.raise_for_status()
print(response.json())
```

### 4. Add the secret and the workflow

Save the key as the `ANTHROPIC_API_KEY` secret, commit the workflow above, then mention `@claude` on a pull request.

Use an id your key serves in `--model`. These are the newest Claude models for Claude Code, at our price per million tokens:

| Model | Id | Input (ours) | Output (ours) | Context |
| --- | --- | --- | --- | --- |
| Claude Sonnet 5.5 | `claude-sonnet-5.5` | $0.60 | $3 | 1M |
| Claude Opus 5.5 | `claude-opus-5.5` | $1.20 | $6 | 1M |
| Claude Fable 5.1 | `claude-fable-5.1` | $3 | $15 | — |

To run Claude Code with the same kind of key on your machine, see [Claude Code setup](https://5abeer.ai/en/docs/apps/claude-code.md#manual). Every model and API format a key opens is on the [API page](https://5abeer.ai/en/api).

## Can it review every pull request on its own?

Yes, in automation mode. This workflow runs Anthropic's `code-review` plugin when a pull request is opened, updated, reopened or marked ready for review:

```yaml
name: Code Review
on:
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened]
env:
  ANTHROPIC_BASE_URL: https://api.5abeer.ai
jobs:
  review:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      pull-requests: read
      issues: read
      id-token: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          plugin_marketplaces: "https://github.com/anthropics/claude-plugins-official.git"
          plugins: "code-review@claude-plugins-official"
          prompt: "/code-review:code-review --comment ${{ github.repository }}/pull/${{ github.event.pull_request.number }}"
          claude_args: '--model claude-sonnet-5.5 --allowedTools "mcp__github_inline_comment__create_inline_comment"'
```

With `--comment`, Claude posts an inline comment on each issue it finds, or one summary comment when it finds none. Keep `--allowedTools`: the action starts the inline-comment tool only when `claude_args` names it. Claude skips drafts, closed pull requests, trivial ones and those it has already commented on.

For a scheduled job, use `on: schedule` with a cron line such as `"0 9 * * *"` and a `prompt`. A plain-text prompt has no shell or GitHub access until you grant tools with `--allowedTools`, or with a `permissions.allow` rule in the `settings` input. GitHub runs schedules only from the default branch and, in public repositories, disables them after 60 days without activity.

## What does each run cost?

GitHub bills Actions minutes under its own pricing, and model tokens are deducted from your 5abeer balance. Most tokens are input: Claude reads `CLAUDE.md`, the diff and the files around it, and every turn sends the conversation so far again.

For example, a review of a mid-sized pull request that reads about 150,000 tokens over its turns and writes 8,000, on the default model:

Example: 150,000 input tokens and 8,000 output tokens on Claude Sonnet 5.5 (`claude-sonnet-5.5`) cost $0.11 at our price against $0.38 at the official price (70% lower). Official price checked October 19, 2026.

Anthropic's docs suggest these ways to lower both costs:

- **Write specific requests.** `@claude fix the TypeError in the dashboard component` needs fewer turns than a vague one.
- **Use issue templates** so Claude gets the context up front.
- **Keep `CLAUDE.md` short.** Claude reads it on every run.
- **Cap each run** with `--max-turns` in `claude_args` and `timeout-minutes` on the job.
- **Limit parallel runs** with GitHub's `concurrency` setting.

Check the CI key's spend in [Track your usage](https://5abeer.ai/en/docs/start/pricing.md#usage). Our price next to the official one is on the [Claude API page](https://5abeer.ai/en/api/claude), and [The cheapest way to use Claude Code](https://5abeer.ai/en/guides/claude-code-cheapest-way) compares a key with a plan.

## Common errors and fixes

If Claude doesn't answer, check that the Claude GitHub App is installed on the repository, that workflows are enabled, that the secret exists, that the comment has `@claude` as a whole word and that the commenter has write access. If CI doesn't run on Claude's commits, remove any `github_token: ${{ secrets.GITHUB_TOKEN }}` line, since GitHub doesn't trigger workflows on commits made with that token.

An authentication error from Anthropic, rather than one of our codes, means the `ANTHROPIC_BASE_URL` line is missing and your key went to Anthropic. Our errors appear in the run log:

- [`INVALID_API_KEY`](https://5abeer.ai/en/docs/help/errors.md#INVALID_API_KEY): the secret holds a wrong or deleted key. Test it with the request above.
- [`MODEL_PLATFORM_NOT_ALLOWED`](https://5abeer.ai/en/docs/help/errors.md#MODEL_PLATFORM_NOT_ALLOWED): the key belongs to a provider other than Claude.
- [`MODEL_UNAVAILABLE`](https://5abeer.ai/en/docs/help/errors.md#MODEL_UNAVAILABLE): the model isn't available right now. Retry, or pick another served id. If a subagent fails, set `ANTHROPIC_DEFAULT_HAIKU_MODEL`, `ANTHROPIC_DEFAULT_SONNET_MODEL` or `ANTHROPIC_DEFAULT_OPUS_MODEL` in `env` to a served id.
- [`INSUFFICIENT_BALANCE`](https://5abeer.ai/en/docs/help/errors.md#INSUFFICIENT_BALANCE): your balance doesn't cover the run. Top up, then re-run the job.
- [`API_KEY_QUOTA_EXHAUSTED`](https://5abeer.ai/en/docs/help/errors.md#API_KEY_QUOTA_EXHAUSTED): the CI key reached its spend limit, often after many runs in one day.

Every code is explained in [Errors and fixes](https://5abeer.ai/en/docs/help/errors.md).

## FAQ

### Can I use my 5abeer plan in GitHub Actions?

Use an API key. Plans are for the supported apps. To use the models from your own code, create an API key. Each run is then billed to your balance, under the key's own spend limit. See [What each plan runs](https://5abeer.ai/en/docs/subscriptions/plan-apps.md#claude-code).

### Does it work with GitHub Enterprise Server?

Quick setup works only with github.com. For self-hosted GitHub, follow Anthropic's [GitHub Enterprise Server](https://code.claude.com/docs/en/github-enterprise-server) guide.

### Does it work with GitLab?

Not this action. `/install-github-app` exits when the repository's remote is on gitlab.com or bitbucket.org. For GitLab pipelines, see [Claude Code GitLab CI/CD](https://code.claude.com/docs/en/gitlab-ci-cd).

### How do I upgrade a workflow from @beta?

Change `@beta` to `@v1`, remove the `mode` input, rename `direct_prompt` to `prompt`, and move `max_turns` and `model` into `claude_args`. `custom_instructions` becomes `--append-system-prompt`.

### Why doesn't the review run on pull requests from forks?

On public repositories, GitHub withholds secrets from runs that fork pull requests trigger, so the action gets no key. Reviews run on pull requests from branches in the same repository.

### How do I pay for the API?

You top up your 5abeer balance with any method in [Payment methods](https://5abeer.ai/en/docs/start/payment.md#methods), and the workflow's API calls draw from that balance.

### Is 5abeer part of Anthropic?

No. 5abeer is an independent service, not affiliated with Anthropic.

## Sources

Checked on 2026-11-01:

- Claude Code docs: [Claude Code GitHub Actions](https://code.claude.com/docs/en/github-actions)
- Claude Code docs: [Model configuration](https://code.claude.com/docs/en/model-config)
- GitHub: [claude-code-action, action.yml](https://github.com/anthropics/claude-code-action/blob/main/action.yml)
- GitHub Docs: [Using secrets in GitHub Actions](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions)

## Get started

Create a key for Claude models, save it as the `ANTHROPIC_API_KEY` secret and commit the workflow above.