Skip to main content
A profile is a named Claude Code identity. Each profile owns an isolated CLAUDE_CONFIG_DIR, its own routing environment variables, and (for auth types that need one) a Keychain-backed secret.

​
Profile isolation

Every profile gets its own CLAUDE_CONFIG_DIR — default ~/.claude-<name>. That directory isolates:
  • credentials.json (subscription OAuth tokens)
  • settings.json (including the OpenRouter cost statusLine, when applicable)
  • .claude.json (user-scope MCP servers, onboarding state, project history)
  • CLAUDE.md
  • Session history
Two profiles never share any of these. Switching between personal and work doesn’t just swap env vars — it points Claude Code at a completely different config tree.

​
Where things live

Cloud profiles (bedrock, vertex, foundry) and subscription profiles store no secret in the Keychain — subscription tokens live in credentials.json inside the profile’s own config dir, and cloud profiles rely on your active cloud CLI session.

​
Listing and inspecting

ccp show prints the profile’s name, auth type, base URL (for gateways), CLAUDE_CONFIG_DIR, and Keychain account reference. Secrets are never printed — there’s no --reveal flag by design.

​
Switching

ccp switch <name> performs an atomic unset-then-apply in the current shell:
Every known Claude Code routing variable — ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, ANTHROPIC_BASE_URL, CLAUDE_CODE_USE_BEDROCK, CLAUDE_CODE_USE_VERTEX, CLAUDE_CODE_USE_FOUNDRY, CLAUDE_CONFIG_DIR, and their neighbors — is unset first, then the new profile’s set is applied. This only works when the zsh wrapper is sourced; see Quickstart.

​
MCP server sets

Each profile has its own user-scope MCP servers, stored in .claude.json inside the profile’s config dir. Apply a set from a JSON file:
The file should be shaped like:
ccp mcp-apply performs a full replace of the mcpServers block in .claude.json — everything else in the file (onboarding state, project history) is preserved. It writes to .claude.json rather than settings.json because that’s the file Claude Code actually reads for user-scope MCP servers (verified against a live install; claude mcp add -s user writes there too).

​
OpenRouter cost visibility

Creating a gateway profile whose base URL contains openrouter.ai automatically wires a statusLine into that profile’s settings.json showing running spend. It uses $ANTHROPIC_AUTH_TOKEN from the profile’s own environment — no secret is duplicated. This is OpenRouter-specific today, since it’s the only gateway with a verified usage-lookup endpoint wired in. Other gateway providers no-op silently rather than guess at an endpoint shape.

​
Export and import

Move a profile’s shape between machines or teammates without ever moving a secret:
ccp export deliberately excludes secrets, Keychain references, and machine-specific paths. ccp import re-collects credentials on the target machine — a fresh OAuth login, a new API key prompt, or a fresh gateway token, depending on the auth type. This is safe to commit to a shared repo or paste in a chat: an exported file contains only the profile’s name, auth type, gateway base URL, and MCP server shape.

​
Deleting

This removes the profile record and its Keychain entry (if any). The profile’s CLAUDE_CONFIG_DIR is left in place, so you don’t lose session history or CLAUDE.md by accident — remove that directory manually if you want a clean slate.