Skip to main content
ccp supports six auth types. Each maps to a different set of environment variables that Claude Code understands, and to a different secret-storage strategy.

​
Supported auth types

​
Subscription

Uses the standard Claude Code OAuth flow tied to your claude.ai Pro, Max, Team, or Enterprise subscription.
ccp launches Claude Code’s browser OAuth flow scoped to the profile’s own CLAUDE_CONFIG_DIR. The resulting credentials.json is written inside that directory — nothing goes to the shared Keychain. Subscription profiles cannot be shared across machines: each machine must complete its own OAuth flow. ccp export / ccp import moves the profile’s shape but forces a fresh login on the target machine.

​
API key

A direct ANTHROPIC_API_KEY from the Anthropic Console.
ccp prompts once for the key (input is masked). The key is stored in the macOS Keychain under service ccp-profile-manager, keyed by the profile’s Keychain account reference. Materializes: ANTHROPIC_API_KEY

​
Gateway

Any Anthropic-compatible proxy — OpenRouter, Requesty, Z.AI, LiteLLM, or an internal gateway.
ccp prompts for the gateway’s base URL (for example https://openrouter.ai/api/v1) and its bearer token. The token goes to the Keychain; the base URL lives in the profile record. Materializes: ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN.
Gateway profiles whose base URL contains openrouter.ai automatically get a cost-visibility statusLine wired into their settings.json. See Profiles.

​
Bedrock

Routes Claude Code through your AWS account.
Bedrock profiles store no local secret. They assume aws sso login is currently active for the target account and region. ccp doctor <name> checks the session’s validity before you rely on the profile mid-task. Materializes: CLAUDE_CODE_USE_BEDROCK=1 (plus your existing AWS_* environment)

​
Vertex

Routes Claude Code through Google Cloud Vertex AI.
Vertex profiles store no local secret. They assume gcloud auth login has established Application Default Credentials on this machine. ccp doctor confirms ADC is reachable. Materializes: CLAUDE_CODE_USE_VERTEX=1

​
Foundry

Routes Claude Code through Azure AI Foundry.
Foundry profiles store no local secret. They assume az login is currently active. ccp doctor confirms the Azure CLI session. Materializes: CLAUDE_CODE_USE_FOUNDRY=1

​
Where secrets live

Secrets for api_key and gateway profiles live in the login Keychain under a single service name, ccp-profile-manager, with each profile’s Keychain account reference as the key. Inspect them with the security CLI:
CLI secret prompts are masked with * on input; piped/non-TTY input falls back to a plain read since there’s no terminal to leak onto. Profile records in ~/.ccp/profiles/ hold only the Keychain account reference — never the secret itself. Because of that, ccp export is safe by construction: it can’t include a secret it never had on disk.