Claude Code API Integration Guide

Why API integration matters in Claude Code

Most real software talks to other services. Databases, payment processors, analytics platforms, third-party APIs, your code doesn't exist in isolation. Claude Code understands this. It can build, debug, and refactor API integrations directly from your terminal, and with MCP servers, it can even call APIs itself during a session.

This guide covers the practical patterns for using Claude Code to build API integrations, from simple REST calls to full MCP server setups that give Claude direct access to external services.

Setting up environment variables

Before connecting to any API, you need credentials. Claude Code handles environment variables the same way your application does, but there are important security considerations.

For application code, use .env files with a library like dotenv:

# .env (never commit this)
STRIPE_SECRET_KEY=sk_live_...
DATABASE_URL=postgres://...
OPENAI_API_KEY=sk-...

Tell Claude Code about your environment structure in your CLAUDE.md file:

## Environment
- API keys are in `.env` (not committed)
- Use `process.env.KEY_NAME` pattern
- Never hardcode credentials in source files
- Test keys use `_test_` prefix, live keys use `_live_`

This way, Claude knows to use environment variables instead of hardcoding secrets. It will also avoid reading or outputting your .env file contents, a guardrail you want when working with sensitive credentials.

For Claude Code's own MCP connections, credentials go in .mcp.json at your project root. More on that below.

Building REST API integrations

Ask Claude Code to build API clients and it generates production-quality code, not tutorial snippets. Here's what a typical workflow looks like.

Start with a clear prompt:

Build a Stripe payment integration module. It should handle:
- Creating customers
- Creating payment intents
- Handling webhooks for payment_succeeded and payment_failed
- Retry logic with exponential backoff
- TypeScript types for all request/response shapes

Claude Code will scaffold the full module, HTTP client setup, error handling, types, and webhook verification. The key is being specific about what you need. Vague prompts like "add Stripe" produce vague results.

For REST patterns, Claude Code consistently applies these best practices:

Centralized HTTP client. Instead of scattered fetch calls, it creates a configured client with base URL, default headers, and interceptors:

const api = createClient({
  baseURL: process.env.API_BASE_URL,
  headers: { Authorization: `Bearer ${process.env.API_KEY}` },
  timeout: 10000,
  retry: { attempts: 3, backoff: 'exponential' }
});

Typed responses. Every endpoint gets request and response types. No any types leaking through your codebase.

Error boundaries. API calls fail. Claude Code wraps them with structured error handling that distinguishes between network errors, auth errors, rate limits, and application errors.

Working with GraphQL

GraphQL integrations follow a similar pattern but with schema awareness. Claude Code can read your GraphQL schema file and generate type-safe queries, mutations, and subscriptions.

Read the GraphQL schema at src/graphql/schema.graphql and build a
type-safe client for the User, Order, and Product types. Use
graphql-request with TypeScript codegen.

Claude Code handles the tooling setup too, configuring graphql-codegen, writing the codegen config, and generating the types. It understands the relationship between your schema, your queries, and your generated types.

For projects using memory systems, you can store your API patterns in a skill file so Claude Code applies your team's conventions consistently across sessions.

MCP servers: giving Claude direct API access

This is where Claude Code gets genuinely different from other AI coding tools. MCP (Model Context Protocol) servers let Claude call external APIs directly during your session, not just generate code that calls them.

An MCP server is a lightweight process that exposes tools to Claude Code. For example, a Meta Ads MCP server lets Claude query your ad performance, create campaigns, and export insights without you writing any code.

Setting up an MCP server

Configuration lives in .mcp.json at your project root:

{
  "mcpServers": {
    "my-api": {
      "command": "npx",
      "args": ["-y", "my-mcp-server"],
      "env": {
        "API_KEY": "your-key-here"
      }
    }
  }
}

Once configured, Claude Code can use the server's tools directly. Ask "What campaigns are running?" and it queries the API, processes the response, and answers, no intermediate code needed.

For a deeper dive into MCP configuration, see our MCP servers guide.

Building your own MCP server

For internal APIs, you can build custom MCP servers. The pattern is straightforward:

import { Server } from '@modelcontextprotocol/sdk/server';

const server = new Server({
  name: 'internal-api',
  version: '1.0.0'
});

server.tool('get_user', { id: 'string' }, async ({ id }) => {
  const user = await fetch(`${API_URL}/users/${id}`);
  return { content: [{ type: 'text', text: JSON.stringify(user) }] };
});

This gives Claude Code direct access to your internal services during development. Need to check what data an endpoint returns? Claude queries it live instead of you switching to Postman.

Authentication patterns

Different APIs use different auth patterns. Here's how to instruct Claude Code for each:

API keys, simplest pattern. Put the key in .env, reference it in headers.

OAuth 2.0, tell Claude Code about your OAuth flow (authorization code, client credentials, etc.) and it'll build the token management: initial exchange, refresh logic, and secure storage.

JWT, Claude Code generates token creation, validation, and middleware. Specify your claims structure and expiration policy.

Webhook signatures, for incoming webhooks, Claude Code builds verification middleware that validates HMAC signatures before processing payloads.

The key is documenting your auth requirements in CLAUDE.md or a skill file. When Claude Code knows your auth pattern upfront, every API module it builds follows the same approach.

Error handling and resilience

API integrations fail in predictable ways. Claude Code builds defensively when you ask for it:

Add resilience to the payment module:
- Retry transient failures (5xx, network errors) with exponential backoff
- Circuit breaker after 5 consecutive failures
- Request timeout of 10s
- Structured error logging with request ID correlation
- Graceful degradation - return cached data when the API is down

This produces production-grade error handling, not the optimistic try/catch you see in tutorials. Claude Code understands the difference between errors you retry (network timeouts) and errors you surface (invalid input).

Testing API integrations

Claude Code generates tests alongside your integration code. Ask for it explicitly:

Write tests for the Stripe module. Mock the HTTP layer -
don't hit the real API. Cover success paths, error paths,
retry behavior, and webhook signature validation.

It'll create test fixtures with realistic API responses, mock the HTTP client, and test edge cases like malformed responses and timeout scenarios. For more on testing patterns, see our testing guide.

Practical workflow: building an integration end-to-end

Here's how a full API integration session looks in practice:

1. Describe the integration: what service, which endpoints, what data flows
2. Claude Code scaffolds: types, client, error handling, config
3. Review and refine: adjust patterns, add edge cases, fix naming
4. Add tests: mock-based unit tests, optionally integration tests
5. Document: Claude Code adds JSDoc comments and updates your API docs

The whole process takes minutes instead of hours. Claude Code handles the boilerplate, you focus on the business logic decisions.

FAQ

Can Claude Code call APIs directly or does it only generate code?

Both. With MCP servers configured, Claude Code can call external APIs directly during your session to query data, create resources, or verify behavior. Without MCP, it generates the code for you to run. The MCP approach is better for development workflows where you need live data.

How do I keep API keys secure when using Claude Code?

Store keys in .env files (never committed to git) and reference them via environment variables. For MCP servers, keys go in .mcp.json which should also be gitignored. Claude Code respects these patterns and won't output your credentials in generated code. Add a note in your CLAUDE.md to reinforce this.

What's the difference between using an MCP server and just writing API code?

An MCP server gives Claude Code live access to an API during your conversation, it can query data, verify responses, and iterate in real time. Writing API code produces the integration for your application to use at runtime. Use MCP for development-time access (debugging, data exploration), and generated code for production runtime.

---

Get Claudify, production-ready API patterns, MCP server configs, and 21 commands that accelerate every integration workflow. Installed in one command: npx create-claudify.