Anthropic · CCDV-F
Hooks, identity, secrets, and keys
CCDV-F · Lesson 18 of 21 · 2:40:28
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the Claude Certified Developer – Foundations exam, on the exam guide version 1.0, effective July 2026. In this lesson: PreToolUse hooks that deny destructive calls, API key storage, rotation, and expiration, keys tied to an identity and workload identity federation, least-privilege roles and workspaces, and monitoring with the Admin API and the Activity Feed. Includes three original practice questions.
Preview the topics
- Driftwood’s team wants Claude Code to never run a recursive delete outside the build folder, even when nobody repeats the rule in the prompt. What enforces it every time?
- Driftwood’s nightly job runs in GitHub Actions with a static Claude API key stored as a repository secret, and the security team wants no lasting Claude key in CI. What should replace it?
- A contractor joins Driftwood for two weeks to test prompts in the playground of one workspace, with no need to manage keys or billing. Which access fits?