Claude API 2026-10-21 migration: what breaks in Node.js

The Claude API 2026-10-21 migration is the first change to the anthropic-version header since 2023-06-01. On October 21, 2026, Anthropic released API version 2026-10-21 together with new major versions of every client SDK, including @anthropic-ai/sdk 1.0.0 for TypeScript and JavaScript. If your SaaS product or browser extension calls Claude from a Node.js backend, upgrading across that major version changes the API version you send, the header your key travels in, and the parameters your requests may contain.

This guide covers what changed, the breaking changes in API version 2026-10-21, what the new Node.js SDK changes in your code (tested side by side with @anthropic-ai/sdk 0.137.0 and 1.1.0), the proxy and gateway problem that will catch extension backends, and a migration checklist. Everything below was checked against Anthropic's migration guide and API versions page on the day of release.

Key takeaways

• API version 2026-10-21 removes temperature, top_p and top_k from the Messages API. Sending any of them returns a 400 error on every model, even at the default value.
• @anthropic-ai/sdk 1.0.0 sends anthropic-version: 2026-10-21 and passes your key as Authorization: Bearer instead of X-Api-Key. Any proxy that reads X-Api-Key breaks.
• TypeScript catches a leftover temperature at compile time. Plain JavaScript does not: in our test the SDK still sent it, and the API will reject it.
• The SDK also removes Text Completions, splits MessageParam by role, allows only one credential per client, needs Node.js 20 or later, and moves from MIT to Apache 2.0.
• 2023-06-01 is still listed and no retirement date has been announced, so you can migrate deliberately rather than in a hurry.

What changed on October 21#

Anthropic's release notes for October 21, 2026 announce three things:

1. A new API version, 2026-10-21. Requests that send anthropic-version: 2026-10-21 get the new behavior; requests that send 2023-06-01 keep the old one.
2. New major SDK versions that send it by default: Python SDK 2.0.0, TypeScript SDK 1.0.0, C# SDK 13.0.0, Go SDK 2.0.0, Java SDK 3.0.0, PHP SDK 1.0.0, Ruby SDK 2.0.0 and ant CLI 2.0.0.
3. A license change. The new SDK and CLI versions are licensed under Apache 2.0 instead of MIT. Earlier versions stay MIT. No code changes are needed, but update your dependency license records.

The rule that decides which version you send is simple: "If you use an SDK, your requests use the API version that was current when your SDK's major version was released." Stay on @anthropic-ai/sdk 0.x and you keep sending 2023-06-01. Move to 1.x and you send 2026-10-21. By the evening of October 21, npm already listed 1.1.0 as latest, so a fresh npm install @anthropic-ai/sdk now gets the new version.

Amazon Bedrock is the exception. There, 2026-10-21 is "available only for Claude 4.7 and later models." If you call an older model on Bedrock, stay on your current SDK until you move that call to a newer model.

Breaking changes in the Claude API 2026-10-21#

The API-level changes are short. They apply to the Messages API, token counting and every request in a Message Batch created with the new version.

The sampling change is the one most backends will hit. Anthropic's guide is explicit about the effect: without the parameters, a request samples with the defaults, "including a temperature of 1.0." Models that already accepted only the defaults, Claude 4.7 and later, behave as before. On older models that accept other values, such as Claude Sonnet 4.6, a request that lowered temperature for more consistent output "loses that effect. No other setting replaces it." If a request depends on a non-default value, the guide offers two options: stop sending the parameter, or keep that request on 2023-06-01.

Many apps were already moving this way. Our post on LLM model retirements in late 2026 covers the "temperature is deprecated for this model" errors that newer Claude models return, and our guide to app review analysis with an LLM already labels reviews without temperature, relying on a fixed schema enum for consistency. Note that both use anthropic-version: 2023-06-01 in their raw fetch examples; that still works, and the next sections show what to change when you move.

What @anthropic-ai/sdk 1.0 changes in your Node.js code#

We installed @anthropic-ai/sdk 0.137.0 (the last 0.x release) and 1.1.0 side by side, pointed each client at a fake fetch that records the outgoing request, and sent the same call with temperature: 0. The results:

Sampling parameters: TypeScript catches them, JavaScript does not#

In TypeScript, a leftover temperature fails to compile against 1.x:

error TS2769: No overload matches this call.
  Object literal may only specify known properties, and 'temperature'
  does not exist in type 'MessageCreateParamsNonStreaming'.

In plain JavaScript there is no such check. The SDK passed temperature: 0 straight through in the request body, which means the first sign of the problem is a 400 error in production. Before you upgrade a JavaScript codebase, search for every place that builds a Messages request:

grep -rnE "temperature|top_p|top_k" --include='*.js' --include='*.mjs' --include='*.ts' src/

Watch for parameters that arrive indirectly: a shared config object, a model-settings table, or an OpenAI-compatible wrapper that adds temperature for every provider.

Text Completions is gone#

client.completions, the Completion types and the HUMAN_PROMPT and AI_PROMPT constants are removed. If any old code still builds "\n\nHuman: ... \n\nAssistant:" prompts, move it to client.messages.create(), where the reply text is in message.content instead of completion.completion.

MessageParam is a union with one type per role#

MessageParam is now UserMessageParam | AssistantMessageParam | SystemMessageParam. A literal such as { role: 'user', content: 'Hello' } still type-checks, so most code is unaffected. Two patterns break:

// Before: an interface cannot extend a union
interface StoredMessage extends Anthropic.MessageParam {
  id: string;
}

// After
type StoredMessage = Anthropic.MessageParam & { id: string };

Code that rewrites message content for any role, such as a function that redacts personal data before sending, has to check role first, because a system message's content accepts only text.

One credential per client#

A client now holds exactly one of apiKey, authToken, credentials, config or profile. Passing two throws:

TypeError: Pass at most one of `apiKey`, `authToken`, `credentials`, `config`, `profile`.
Received `apiKey`, `authToken`.

With nothing passed, the client takes the first of ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, a named profile, workload identity federation variables and the active profile on disk. If both environment variables are set on a server, the API key wins and the client logs a warning once.

Smaller changes#

• Models: client.models.list() and retrieve() no longer take betas; call client.beta.models.list({ betas }) instead.
• Tool runner: the compactionControl option is removed in favor of server-side compaction through context_management.
• Platform packages: @anthropic-ai/bedrock-sdk, vertex-sdk, foundry-sdk, aws-sdk and google-cloud-sdk must move to v1 in the same upgrade. Otherwise "your package manager installs a second, older copy of @anthropic-ai/sdk."
• Runtime: the SDK README lists "Node.js 20 LTS or later" as the requirement.

Proxies and gateways that read X-Api-Key#

This is the change most likely to break a browser extension's backend without any code change in the backend itself.

A common setup for AI extensions keeps the provider key on a server and gives the extension its own short-lived token, as our guide to hiding an API key in a Chrome extension recommends. Some teams also put a gateway or proxy between their own services and Anthropic, and point the SDK at it with baseURL. If that proxy reads, logs, rate-limits or rewrites the key from the X-Api-Key header, it stops seeing it after the upgrade, because 1.x sends Authorization: Bearer <key> instead.

Anthropic notes that "the Claude API accepts a key in either header, so a program that talks to the API directly needs no change." The problem is only in what sits in between. You have two fixes:

1. Change the proxy to read the key from Authorization, after Bearer . This is the better long-term fix.
2. Make the SDK send X-Api-Key again while you update the proxy:

import Anthropic from '@anthropic-ai/sdk';

const client = new Anthropic({
  apiKey: process.env.ANTHROPIC_API_KEY,
  baseURL: process.env.LLM_GATEWAY_URL,
  // Send the key where the gateway expects it, and not in Authorization.
  defaultHeaders: { 'X-Api-Key': process.env.ANTHROPIC_API_KEY, Authorization: null },
});

Two related details from the guide: if you set X-Api-Key in a single request's headers to switch keys, 1.x now sends both keys, so pass Authorization: `Bearer ${otherKey}` instead; and a client with no credential at all (because the gateway adds one) is now declared with Authorization: null only, not "X-Api-Key": null.

If you call the API with fetch#

Many extension backends skip the SDK and call the API with fetch, as several of our own examples do. For them the migration is two lines: change the header and drop the sampling parameters.

const res = await fetch('https://api.anthropic.com/v1/messages', {
  method: 'POST',
  headers: {
    authorization: `Bearer ${process.env.ANTHROPIC_API_KEY}`, // x-api-key also works
    'anthropic-version': '2026-10-21',
    'content-type': 'application/json',
  },
  body: JSON.stringify({
    model: 'claude-haiku-5-5',
    max_tokens: 1024,
    // No temperature, top_p or top_k on 2026-10-21.
    messages: [{ role: 'user', content: 'Summarize this review in one sentence.' }],
  }),
});

Message Batches follow the same rule: each request in a batch created with 2026-10-21 is validated under the new version, so a nightly review-labeling job that still sets temperature will fail request by request. Streaming code, such as the server-sent events relay in our guide to streaming AI responses in a Chrome extension, needs only the header change.

Claude API 2026-10-21 migration checklist#

1. Inventory every caller. List each service, job and function that calls Claude, which SDK version it uses, and whether it sends anthropic-version itself.
2. Remove temperature, top_p and top_k from every request, including shared configs and wrappers. Decide explicitly which requests, if any, must stay on 2023-06-01.
3. Check documents and citations. Make sure documents only appear in user turns and that user turns carry no citations arrays.
4. Fix anything that reads X-Api-Key: gateways, logging middleware, custom fetch functions and rate limiters.
5. Upgrade the SDK and its platform packages together (npm install @anthropic-ai/sdk@^1), on Node.js 20 or later, then run tsc --noEmit. The compiler finds most of the remaining changes.
6. Run the integration tests against the live API with a test key before deploying, as the guide's last step says.
7. Update the Admin API fields if you read API keys, rate limits or RBAC groups.
8. Record the license change in your dependency inventory.
9. Deploy, then watch. Track 400 errors by endpoint for the first day, and pin the SDK version once it works.

For the watching step, our guide to LLM observability with OpenTelemetry shows how to trace Claude calls per route, and our post on LLM API rate limits explains how to tell a 400 from a 429 so the retry loop does not hide the problem.

Watch your users, not only your logs#

Logs show request errors. Users show everything else. If a response changes tone after the sampling defaults change, or a feature quietly fails for one locale, the first signal is often a review: "the AI summaries got worse after the update." For an extension or app with an AI feature, put the deploy date next to your rating and review volume for the following week. If the AI feature ships inside a mobile app, the release dates in your App Store version history give you the markers to line up against.

That is what Extenify is built for. The extension and app analytics dashboard records ratings, reviews, users and versions for your Chrome Web Store, Edge Add-ons, Firefox Add-ons, Google Play and App Store listings every day and alerts you to email, Slack, Telegram, Discord or Teams when ratings drop or new low-star reviews arrive. Our guide to Chrome extension review notifications covers what to alert on. Every plan starts with a 7-day free trial with no credit card required, and the pricing page lists the plans.

Frequently asked questions#

Do I have to migrate to Claude API version 2026-10-21 now?#

No. The versions page still lists 2023-06-01, and Anthropic has not announced a retirement date for it. Requests keep their current behavior as long as you keep sending 2023-06-01, which the 0.x Node.js SDK does. Anthropic recommends using the latest version whenever possible, so plan the move rather than skip it.

Why does my Claude request return 400 for temperature?#

On API version 2026-10-21, temperature, top_p and top_k are removed, and sending any of them returns a 400 error on every model, even at the default value. On 2023-06-01, Claude 4.7 and later models already rejected non-default values. Remove the parameter from the request.

Does the Claude API still accept the x-api-key header?#

Yes. The API accepts a key in either X-Api-Key or Authorization: Bearer. What changed is the SDK: version 1.x of the TypeScript SDK sends the key as a bearer token, so proxies and middleware that read X-Api-Key need updating.

Which @anthropic-ai/sdk version uses API version 2026-10-21?#

Version 1.0.0 and later. Every 0.x release sends 2023-06-01. The other first versions to use the new API version are Python 2.0.0, C# 13.0.0, Go 2.0.0, Java 3.0.0, PHP 1.0.0, Ruby 2.0.0 and ant CLI 2.0.0.

Does 2026-10-21 work on Amazon Bedrock?#

Only for Claude 4.7 and later models. For older models on Bedrock, Anthropic says to stay on your current SDK version, or keep sending the version you send today, until you switch to a newer model.

Summary#

The Claude API 2026-10-21 migration is small at the API level and larger in the SDK. The API removes temperature, top_p and top_k, rejects documents in assistant turns and citations in user turns, and renames a handful of Admin API fields. @anthropic-ai/sdk 1.0 sends the new version, moves your key to Authorization: Bearer, removes Text Completions, splits MessageParam by role, allows one credential per client and requires Node.js 20 or later. Remove the sampling parameters everywhere, fix any proxy that reads X-Api-Key, upgrade the SDK and its platform packages together, let the TypeScript compiler find the rest, and watch both your error logs and your users after you deploy.

Image credits#

• Cover photo: Two disused railroad tracks diverging into greenery by Mehraz Morshed on the WordPress Photo Directory, CC0.