Use eb1 with Claude Code

Keiro's installer adds a claude-keiro command that starts the stock Claude Code CLI on the public eb1 models. No fork of Claude Code is involved, and your existing claude command keeps its own settings and credentials.

Copy Page https://docs.keirolabs.ai/claude-code.md

Before you install#

A dedicated key lets you inspect and revoke Claude Code traffic independently from production application traffic.

1. Open API keys.
2. Create a dedicated key for this Claude Code installation.
3. Keep the newly revealed secret available in your password manager until setup is complete.
4. Run the installer from an interactive terminal so it can prompt without echoing the secret.

Install and configure#

Download the installer instead of piping a mutable response directly to a shell:

1
2
3

curl --proto '=https' --tlsv1.2 -fsS \
  https://api.keirolabs.ai/v1/claude-code/install.sh \
  -o keiro-claude-code-install.sh

The response carries an X-Content-SHA256 header holding the SHA-256 checksum of the exact bytes served (add -D - to the command above to print the headers). Compare it against shasum -a 256 keiro-claude-code-install.sh to confirm the download arrived intact.

Inspect the local copy, then run it:

1
2
3

less keiro-claude-code-install.sh
bash keiro-claude-code-install.sh
rm keiro-claude-code-install.sh

If Claude Code is not installed, the script says so and installs it with npm when npm is available. It then prompts for the Keiro API key, verifies the key with one authenticated request to the API, stores it with owner-only permissions, and writes the claude-keiro launcher along with a keiro-claude alias.

Installing from a script with no terminal to prompt from? Store the key in a file only you can read and pass it by path — the installer never accepts the secret itself as a command argument:

1

bash keiro-claude-code-install.sh --key-file <path-to-key-file>

The key check fails the install — without storing anything — when the API answers 401 (the key is invalid or revoked) or 403 (the key lacks access). If the API cannot be reached, or curl is missing, the installer notes that the key is unverified and continues.

The installer is idempotent. Every artifact it writes is replaced or skipped, and it never edits ~/.claude/settings.json, your shell startup files, or the stock claude command. It closes by listing the files it wrote, and its last line is the verdict: Verified against the API followed by Done. when the stored key answered the check, Done (key stored, not verified) when the check could not run, or — if no key is stored by the end of a run — the manual store command, Setup incomplete: no API key stored., and a nonzero exit.

Launch Claude Code#

1

claude-keiro

claude-keiro accepts the same arguments as claude, so claude-keiro --resume resumes a session the same way claude --resume does. Requests appear in Keiro Usage and Logs like other API traffic. keiro-claude is an alias for the same launcher; either spelling starts the same session.

Use /model inside Claude Code to switch tiers. Each tier is pinned to a public eb1 model, in descending capability order:

These four public eb1 model IDs are the only ones the tiers resolve to. Claude model IDs are not part of the public Keiro catalog, and a request carrying one is rejected.

The model picker#

claude-keiro runs a small helper, ~/.claude/keiro-shim.py, on a loopback port for the lifetime of the session. The helper lets the /model picker list the eb1 models — eb1-preview, eb1-frontier-preview, eb1-fast-preview, and eb1-efficient-preview — as rows marked "From gateway", with the active model checked. Requests flow through the helper on your machine only; your key and prompts go to Keiro and nowhere else.

Inside the picker the eb1 rows carry a local claude-eb1-* spelling, which is what lets Claude Code display them; the pinned tier rows override their display name to the canonical eb1-* ID, so what you read in the picker is what Usage and Logs show. The helper translates the local spelling back before any request leaves your machine, so the Usage and Logs pages always show the canonical eb1-* model IDs. Client-side output uses the local spelling too: Claude Code's own JSON results (for example claude -p --output-format json) report claude-eb1-* model IDs, while the server-side Usage and Logs pages remain the canonical record.

The helper needs python3 on your PATH. Without it, claude-keiro starts Claude Code against Keiro directly: everything works the same, except the /model picker cannot list eb1 rows — the stock tier names remain pinned to the table above. While the helper runs it records each request in ~/.claude/keiro-shim.log; see Troubleshooting for reading it. Set KEIRO_SHIM_LOG to write the log to a different path.

Files written by setup#

The launcher reads the key file at startup and passes the secret to the Claude Code process only. Nothing writes it into the launcher body, a settings file, or your shell history.

Set CLAUDE_CONFIG_DIR before installing to keep the key beside a non-default Claude Code configuration directory, or KEIRO_BIN_DIR to write the launcher somewhere other than ~/.local/bin.

Manage the setup#

The launcher carries a self namespace for local management, so removal never requires re-fetching the installer:

1
2
3

claude-keiro self status      # show what the setup manages
claude-keiro self uninstall   # remove the launcher and helper
claude-keiro self help        # list these commands

self status lists the launcher, helper, and key-file paths and whether each is present, plus the helper log locations and whether claude-keiro resolves on your PATH. The key file's contents are never shown.

self uninstall removes the launcher, its keiro-claude alias, the model picker helper, and the helper logs. The key file is never deleted: the command prints the exact rm line to run yourself if you also want the stored secret gone. Plain claude is never changed.

Set up without the installer#

The launcher only sets documented Claude Code environment variables. Pass the same set yourself, scoped to the one command so nothing lingers in your shell:

1
2
3
4
5
6
7
8
9
10
11

KEIRO_BASE_URL=https://api.keirolabs.ai/v1

ANTHROPIC_BASE_URL="${KEIRO_BASE_URL%/v1}" \
ANTHROPIC_AUTH_TOKEN="$(cat ~/.claude/keiro-api-key)" \
ANTHROPIC_MODEL="eb1-preview" \
ANTHROPIC_DEFAULT_OPUS_MODEL="eb1-preview" \
ANTHROPIC_DEFAULT_SONNET_MODEL="eb1-efficient-preview" \
ANTHROPIC_DEFAULT_HAIKU_MODEL="eb1-fast-preview" \
ANTHROPIC_DEFAULT_FABLE_MODEL="eb1-frontier-preview" \
CLAUDE_CODE_SUBAGENT_MODEL="eb1-efficient-preview" \
claude

Keep the secret in a file only you can read and pass it in at launch, as above. The path is yours to choose; the installer uses ~/.claude/keiro-api-key with mode 0600. Do not put the secret in a shell startup file.

This path runs without the local helper, so the /model picker does not list eb1 rows; the tier variables above still pin every tier to an eb1 model.

ANTHROPIC_BASE_URL is the API root without the /v1 suffix. Claude Code appends /v1/messages itself, so a value that already ends in /v1 produces a 404.

ANTHROPIC_AUTH_TOKEN is sent as Authorization: Bearer, the same credential form as every other public endpoint. See API auth.

Client limitations#

Claude Code reserves some of its interface for its own endpoint. These limits come from the client, not from Keiro:

• The /model picker shows no pricing and no reasoning-effort control for eb1 models. Pick the variant that fits the task and read cost in Keiro Usage instead.
• /fast and Remote Control are unavailable while ANTHROPIC_BASE_URL points at Keiro.
• Extended thinking is not shown in the transcript. Answers arrive complete; only the intermediate display is missing.

Rotate the Claude Code key#

Do not pass the secret in a command argument or save it in shell history.

1. Create a replacement dedicated key in the console.
2. Remove the old local key file.
3. Run the installer again and enter the replacement secret at the prompt.
4. Launch claude-keiro and verify a harmless request.
5. Delete the old key in the console.

Remove the setup#

Setup owns exactly the files in the table above; the stock claude command and ~/.claude/settings.json are never touched. The launcher removes its own artifacts:

1

claude-keiro self uninstall

This deletes the launcher, its keiro-claude alias, the model picker helper, and the helper logs, wherever CLAUDE_CONFIG_DIR or KEIRO_BIN_DIR put them. The key file survives; the command prints the exact rm line to delete it too. If the launcher itself is already gone, remove the remaining files by hand:

1

rm -f ~/.local/bin/claude-keiro ~/.local/bin/keiro-claude ~/.claude/keiro-shim.py ~/.claude/keiro-shim.log ~/.claude/keiro-shim.log.1 ~/.claude/keiro-shim-diag.log ~/.claude/keiro-api-key

Delete the key in API keys once nothing else uses it.

Troubleshooting#

The installer's last line is its verdict. Done. after a Verified against line means the stored key answered an authenticated request during the run. Done (key stored, not verified) means the files are in place but the check could not run — the API was unreachable or curl is missing — so the first launch is where an invalid key would surface. Setup incomplete: no API key stored. with a nonzero exit means the run stored nothing; use the printed store command or --key-file, then rerun the installer.

claude-keiro: missing key file means setup did not store a key. Run the installer from an interactive terminal and enter an active key, or rerun it with --key-file.

command not found: claude-keiro means the launcher directory is not on your PATH. The installer names the directory and the launcher's full path; it does not edit shell startup files for you.

At startup Claude Code may print a notice that claude.ai connectors are disabled. The message comes from the Claude Code client, which shows it for any non-default endpoint; it is informational and requests to Keiro are unaffected.

If the /model picker shows only the stock tier names, python3 was not found at launch, or the helper failed to start — its startup errors print to the terminal. Install python3 and start claude-keiro again.

If claude is still missing after setup, install it with npm and run the Keiro installer again.

A 401 means the stored key is missing, invalid, or revoked. A model error means the selected model is not enabled for that key. Check the console's API Keys and Models pages before retrying.

To find the request id for a specific response, read ~/.claude/keiro-shim.log: the helper writes one line per request with the timestamp, method, path, model, request id, and HTTP status, rotating the file near 1 MB with the previous portion kept in ~/.claude/keiro-shim.log.1. The helper never writes to the terminal while Claude Code runs; after a session with failed requests, claude-keiro prints how many there were and points at the log. Include the request id when contacting support about a response.

Related pages#

• Agent-driven setup
• API keys
• API auth
• Models
• Messages API
• Usage and billing
• Claude Code gateway documentation