Claude API 2026-10-21: What Breaks When You Upgrade

Anthropic shipped 2026-10-21 on October 21. It's the first new anthropic-version since 2023-06-01, which is the string almost every integration I've ever written hardcodes. The official migration guide is long because it covers eight SDKs. The API-level changes fit in a short list:

• Sampling parameters removed. temperature, top_p and top_k return 400 on Messages, token counting and every request inside a Message Batch.
• Documents only in user turns. A document block placed directly in an assistant message is rejected.
• No citations on user text. A user text block with a non-empty citations array is rejected.
• Admin API renames. roles → role_ids, group_id → rbac_group_id, workspace_id on API keys → scope, plus a couple more.

Then there's a second list that has nothing to do with the API version: the new SDKs send your key as a Bearer token, drop Text Completions, change some types, and are now licensed Apache 2.0 instead of MIT. The SDK changes are where most of the surprises are.

Takeaway: the version only changes when you upgrade the SDK or edit the header. You choose when this lands.

I didn't want to trust a changelog for this, so I ran a grid against api.anthropic.com: three models, both versions, temperature at 1.0 and 0.2, top_p 0.9, top_k 40, and a control with no sampling parameters. Every call used max_tokens: 1, so the whole test cost fractions of a cent. 30 calls, October 25, 2026:

Two things worth knowing. First, the newer models were already locked down before this version existed. On 2023-06-01, Sonnet 5.5 and Haiku 5.5 accept temperature: 1.0and nothing else. If you moved to them, you've already met this wall, just with a different error. The docs say the same about Claude 4.7 and later.

Second, the new version is stricter than "use the default". Sending temperature: 1.0, the exact value the API uses anyway, still gets a 400. That's the one that'll bite: lots of wrappers and config files set it explicitly just to be safe. Here are the exact errors, which are worth putting in your log alerts:

# 2023-06-01, Sonnet 5.5 / Haiku 5.5, temperature 0.2
400  `temperature` is deprecated for this model.

# 2026-10-21, any model, temperature 1.0 (yes, the default)
400  temperature: Extra inputs are not permitted

# 2026-10-21, document block inside an assistant message
400  messages: `document` blocks can't be placed directly in `assistant` messages;
     send them in a `user` message.

# 2026-10-21, citations on a user text block
400  messages: text blocks in `user` messages can't have `citations`;
     remove `citations` from them.

The real loss is on Sonnet 4.6. It's the last model in my grid that honored a low temperature, and on 2026-10-21 that knob is gone with no replacement. If you have a classifier on Sonnet 4.6 that leans on temperature: 0 for consistency, test it before you switch. I wrote about getting consistency from prompts and output schemas instead in structured outputs vs tool use.

Takeaway: on 2026-10-21, delete the three parameters everywhere. Even a harmless-looking temperature: 1.0 is a hard failure.

Because the key isn't where your proxy is looking anymore. I pointed four SDK versions at a tiny local server that logs headers, then at a second one that behaves like an older gateway: it returns 401 unless X-Api-Key is present. Same code, same key:

The Claude API itself doesn't care. I called /v1/models with the key in each header on both versions, plus /v1/messages with a Bearer key on 2026-10-21, and all of them returned 200. The breakage is in everything you put between your code and Anthropic: a homegrown proxy that injects keys, a gateway with per-team budgets, middleware that redacts x-api-key from logs (and now happily logs the Bearer token), test stubs that assert on the header. If you run a self-hosted LLM gateway, check its Anthropic passthrough before your app team bumps the SDK.

One more finding the docs don't spell out: when both headers are present, the API authenticates with X-Api-Key. A valid X-Api-Key plus a garbage Bearer token returned 200. A valid Bearer token plus a garbage X-Api-Keyreturned 401 "invalid x-api-key". That matters because the docs warn that setting X-Api-Key per request in the new SDKs no longer replaces the client key: both go out. If a stale key sits in a default header somewhere, it wins.

The fix on the proxy side is small. Read either header:

// Accept the key from either header before forwarding to Anthropic
function getAnthropicKey(req: Request): string | null {
  const xKey = req.headers.get("x-api-key");
  if (xKey) return xKey;
  const auth = req.headers.get("authorization") ?? "";
  return auth.toLowerCase().startsWith("bearer ") ? auth.slice(7).trim() : null;
}

Takeaway: fix the gateway first, then upgrade the SDK. Doing it the other way around gives you a production 401 with a perfectly valid key.

Sometimes. Python SDK 2.3.0 refuses it up front: Messages.create() got an unexpected keyword argument 'temperature'. So did 1.17.0, which matches what I found when the Python SDK hit v1.0 in August. That error is the good outcome. It fails in dev, not in prod.

Three paths skip that check, and I confirmed each one reaches the API:

• Plain JavaScript. TypeScript SDK 1.3.0 types reject temperature, but a .js file or an as any cast sent it straight through to my stub.
• extra_body. extra_body={"temperature": 0.2}on Python 2.3.0 went out and came back as a real 400: "temperature: Extra inputs are not permitted".
• Config-driven requests. Anything that builds the body from YAML, a database row or a prompt-management tool never touches the typed signature.

So grep for it instead of trusting the compiler:

rg -n "temperature|top_p|top_k" --glob '!node_modules' .
rg -n -i "x-api-key" --glob '!node_modules' .   # proxies, middleware, log filters, stubs
rg -n "extra_body|anthropic-version" --glob '!node_modules' .

If one call genuinely needs a low temperature on Sonnet 4.6, the docs say to keep that request on 2023-06-01. With the new Python SDK, that worked for me by overriding the header on a separate client. The stub showed the old version header going out, and the same call against the live API returned 200:

import anthropic

# New SDK, old API version, for the one call that still needs temperature
legacy = anthropic.Anthropic(default_headers={"anthropic-version": "2023-06-01"})
legacy.messages.create(
    model="claude-sonnet-4-6",
    max_tokens=512,
    messages=[{"role": "user", "content": "..."}],
    extra_body={"temperature": 0.2},  # the 2.x method no longer has the argument
)

Treat it as a bridge, not a plan. Sonnet 4.6 is the only model in my test where that knob still does anything, and it won't be around forever. I covered how fast these windows close in the Sonnet 4.5 deprecation post.

Not today. I opened the n8nio/n8n:2.44.6 image (the current stable tag) and checked what it ships: @anthropic-ai/sdk 0.115.0 under @langchain/anthropic 1.5.6. That SDK sends 2023-06-01 and X-Api-Key, so the Anthropic Chat Model node keeps working, including its Sampling Temperature option.

The risk comes later. When n8n moves to a newer Anthropic SDK, any node where someone set Sampling Temperature (that LangChain wrapper forwards temperature into the request) is exactly the shape that gets a 400 on the new version. When you read an n8n release note that mentions the Anthropic packages, go clear that option on your Claude nodes before you update the instance. HTTP Request nodes calling the API directly are simpler: they send whatever anthropic-versionyou typed, so they move only when you change them. If you're wiring Claude into n8n anyway, prompt caching in n8n is a better use of the afternoon than chasing temperature values.

This is the order I'd use on a production integration:

1. Grep for sampling params in code, configs, templates and extra_body. Delete them. Re-test outputs on any Sonnet 4.6 path that used a low temperature.
2. Fix the auth path. Every proxy, gateway, log filter and stub that reads X-Api-Key should accept Authorization: Bearer too.
3. Check message shapes. Documents go in user turns. Strip citations from user text blocks, which usually happens when you replay a cited answer as user context.
4. Rename Admin API fields if you read RBAC groups, rate limits or API key scopes.
5. Upgrade the SDK, then watch logsfor "Extra inputs are not permitted", "can't be placed directly" and 401 "invalid x-api-key". Same idea as my 429 rate-limit playbook: alert on the exact error string, not on a generic 4xx count.

Also check the Bedrock row of the versioning page if you run there: 2026-10-21 is only available for Claude 4.7 and later models on Amazon Bedrock.

Takeaway: no deadline is forcing this yet. Take a day, do it in that order, and the upgrade is boring, which is what you want.