> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kloudlinq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Profiles

> How ccp stores, isolates, and moves profiles

A **profile** is a named Claude Code identity. Each profile owns an isolated `CLAUDE_CONFIG_DIR`, its own routing environment variables, and (for auth types that need one) a Keychain-backed secret.

## Profile isolation

Every profile gets its own `CLAUDE_CONFIG_DIR` — default `~/.claude-<name>`. That directory isolates:

* `credentials.json` (subscription OAuth tokens)
* `settings.json` (including the OpenRouter cost `statusLine`, when applicable)
* `.claude.json` (user-scope MCP servers, onboarding state, project history)
* `CLAUDE.md`
* Session history

Two profiles never share any of these. Switching between `personal` and `work` doesn't just swap env vars — it points Claude Code at a completely different config tree.

## Where things live

| Part                    | Location                                         | Contents                                                                                    |
| ----------------------- | ------------------------------------------------ | ------------------------------------------------------------------------------------------- |
| Profile records         | `~/.ccp/profiles/`                               | Name, auth type, base URL, `CLAUDE_CONFIG_DIR`, Keychain account reference — never a secret |
| Secrets                 | macOS Keychain (`ccp-profile-manager` service)   | API keys, gateway bearer tokens                                                             |
| Per-profile config      | `CLAUDE_CONFIG_DIR` (default `~/.claude-<name>`) | Everything Claude Code reads at runtime                                                     |
| Workspace pin (VS Code) | `.vscode/ccp.local.json`                         | Profile *name* the workspace expects (no secrets)                                           |

Cloud profiles (`bedrock`, `vertex`, `foundry`) and `subscription` profiles store no secret in the Keychain — subscription tokens live in `credentials.json` inside the profile's own config dir, and cloud profiles rely on your active cloud CLI session.

## Listing and inspecting

```bash theme={null}
ccp list          # every profile; * marks the active one
ccp show work     # full profile record as JSON (no secrets)
```

`ccp show` prints the profile's name, auth type, base URL (for gateways), `CLAUDE_CONFIG_DIR`, and Keychain account reference. Secrets are never printed — there's no `--reveal` flag by design.

## Switching

`ccp switch <name>` performs an atomic unset-then-apply in the current shell:

```bash theme={null}
ccp switch work
```

Every known Claude Code routing variable — `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, `ANTHROPIC_BASE_URL`, `CLAUDE_CODE_USE_BEDROCK`, `CLAUDE_CODE_USE_VERTEX`, `CLAUDE_CODE_USE_FOUNDRY`, `CLAUDE_CONFIG_DIR`, and their neighbors — is unset first, then the new profile's set is applied. This only works when the zsh wrapper is sourced; see [Quickstart](/ccp/quickstart#2-source-the-zsh-wrapper).

## MCP server sets

Each profile has its own user-scope MCP servers, stored in `.claude.json` inside the profile's config dir. Apply a set from a JSON file:

```bash theme={null}
ccp mcp-apply personal ./mcp-sets/homelab.json
```

The file should be shaped like:

```json theme={null}
{
  "mcpServers": {
    "homelab": {
      "command": "node",
      "args": ["/opt/mcp/homelab.js"]
    }
  }
}
```

`ccp mcp-apply` performs a **full replace** of the `mcpServers` block in `.claude.json` — everything else in the file (onboarding state, project history) is preserved. It writes to `.claude.json` rather than `settings.json` because that's the file Claude Code actually reads for user-scope MCP servers (verified against a live install; `claude mcp add -s user` writes there too).

## OpenRouter cost visibility

Creating a `gateway` profile whose base URL contains `openrouter.ai` automatically wires a `statusLine` into that profile's `settings.json` showing running spend. It uses `$ANTHROPIC_AUTH_TOKEN` from the profile's own environment — no secret is duplicated.

This is OpenRouter-specific today, since it's the only gateway with a verified usage-lookup endpoint wired in. Other gateway providers no-op silently rather than guess at an endpoint shape.

## Export and import

Move a profile's *shape* between machines or teammates without ever moving a secret:

```bash theme={null}
ccp export personal --out personal.ccp-profile.json
ccp import personal.ccp-profile.json
```

`ccp export` deliberately excludes secrets, Keychain references, and machine-specific paths. `ccp import` re-collects credentials on the target machine — a fresh OAuth login, a new API key prompt, or a fresh gateway token, depending on the auth type.

This is safe to commit to a shared repo or paste in a chat: an exported file contains only the profile's name, auth type, gateway base URL, and MCP server shape.

## Deleting

```bash theme={null}
ccp delete work
```

This removes the profile record and its Keychain entry (if any). The profile's `CLAUDE_CONFIG_DIR` is left in place, so you don't lose session history or `CLAUDE.md` by accident — remove that directory manually if you want a clean slate.