> Keiro Labs API documentation - Claude Code Setup > Page: https://docs.keirolabs.ai/claude-code.html > Markdown: https://docs.keirolabs.ai/claude-code.md > Agent index: https://docs.keirolabs.ai/llms.txt > API base URL: https://api.keirolabs.ai/v1 > Auth: send "Authorization: Bearer " with a key created in the > Keiro console (https://console.keirolabs.ai/api-keys). Use credentials saved by > `keiro setup`, or resolve the key from a secret manager or an owner-only > secret file and pass it to the client explicitly. Never read another > provider's variable, and never put raw key material in environment > variables, code, docs, or logs. # Use eb1 with Claude Code Keiro's installer adds a `claude-keiro` command that starts the stock Claude Code CLI on the public eb1 models. No fork of Claude Code is involved, and your existing `claude` command keeps its own settings and credentials. ## Before you install 1. Open [API keys](https://console.keirolabs.ai/api-keys). 2. Create a dedicated key for this Claude Code installation. 3. Keep the newly revealed secret available in your password manager until setup is complete. 4. Run the installer from an interactive terminal so it can prompt without echoing the secret. A dedicated key lets you inspect and revoke Claude Code traffic independently from production application traffic. ## Install and configure Download the installer instead of piping a mutable response directly to a shell: ```bash curl --proto '=https' --tlsv1.2 -fsS \ https://api.keirolabs.ai/v1/claude-code/install.sh \ -o keiro-claude-code-install.sh ``` The response carries an `X-Content-SHA256` header holding the SHA-256 checksum of the exact bytes served (add `-D -` to the command above to print the headers). Compare it against `shasum -a 256 keiro-claude-code-install.sh` to confirm the download arrived intact. Inspect the local copy, then run it: ```bash less keiro-claude-code-install.sh bash keiro-claude-code-install.sh rm keiro-claude-code-install.sh ``` If Claude Code is not installed, the script says so and installs it with npm when npm is available. It then prompts for the Keiro API key, verifies the key with one authenticated request to the API, stores it with owner-only permissions, and writes the `claude-keiro` launcher along with a `keiro-claude` alias. Installing from a script with no terminal to prompt from? Store the key in a file only you can read and pass it by path — the installer never accepts the secret itself as a command argument: ```bash bash keiro-claude-code-install.sh --key-file ``` The key check fails the install — without storing anything — when the API answers `401` (the key is invalid or revoked) or `403` (the key lacks access). If the API cannot be reached, or `curl` is missing, the installer notes that the key is unverified and continues. The installer is idempotent. Every artifact it writes is replaced or skipped, and it never edits `~/.claude/settings.json`, your shell startup files, or the stock `claude` command. It closes by listing the files it wrote, and its last line is the verdict: `Verified against` the API followed by `Done.` when the stored key answered the check, `Done (key stored, not verified)` when the check could not run, or — if no key is stored by the end of a run — the manual store command, `Setup incomplete: no API key stored.`, and a nonzero exit. ## Launch Claude Code ```bash claude-keiro ``` `claude-keiro` accepts the same arguments as `claude`, so `claude-keiro --resume` resumes a session the same way `claude --resume` does. Requests appear in Keiro Usage and Logs like other API traffic. `keiro-claude` is an alias for the same launcher; either spelling starts the same session. Use `/model` inside Claude Code to switch tiers. Each tier is pinned to a public eb1 model, in descending capability order: | Claude Code tier | Keiro model | |---|---| | Fable | `eb1-frontier-preview` | | Opus, and the session default | `eb1-preview` | | Sonnet | `eb1-efficient-preview` | | Haiku | `eb1-fast-preview` | | Subagents | `eb1-efficient-preview` | These four public eb1 model IDs are the only ones the tiers resolve to. Claude model IDs are not part of the public Keiro catalog, and a request carrying one is rejected. ## The model picker `claude-keiro` runs a small helper, `~/.claude/keiro-shim.py`, on a loopback port for the lifetime of the session. The helper lets the `/model` picker list the eb1 models — `eb1-preview`, `eb1-frontier-preview`, `eb1-fast-preview`, and `eb1-efficient-preview` — as rows marked "From gateway", with the active model checked. Requests flow through the helper on your machine only; your key and prompts go to Keiro and nowhere else. Inside the picker the eb1 rows carry a local `claude-eb1-*` spelling, which is what lets Claude Code display them; the pinned tier rows override their display name to the canonical `eb1-*` ID, so what you read in the picker is what Usage and Logs show. The helper translates the local spelling back before any request leaves your machine, so the Usage and Logs pages always show the canonical `eb1-*` model IDs. Client-side output uses the local spelling too: Claude Code's own JSON results (for example `claude -p --output-format json`) report `claude-eb1-*` model IDs, while the server-side Usage and Logs pages remain the canonical record. The helper needs `python3` on your `PATH`. Without it, `claude-keiro` starts Claude Code against Keiro directly: everything works the same, except the `/model` picker cannot list eb1 rows — the stock tier names remain pinned to the table above. While the helper runs it records each request in `~/.claude/keiro-shim.log`; see Troubleshooting for reading it. Set `KEIRO_SHIM_LOG` to write the log to a different path. ## Files written by setup | Path | Purpose | Permission posture | |---|---|---| | `~/.local/bin/claude-keiro` | Launcher that starts Claude Code on eb1 | Executable mode `0755` | | `~/.local/bin/keiro-claude` | Alias; either name starts the same session | Symlink to the launcher | | `~/.claude/keiro-shim.py` | Local helper that lists eb1 models in the model picker | Mode `0644`, holds no secrets | | `~/.claude/keiro-api-key` | API-key secret | Owner-only mode `0600` | | `~/.claude/keiro-shim.log` | Helper request log — written by the launcher at each run, not by the installer; `KEIRO_SHIM_LOG` moves it | Rotated near 1 MB with a `.1` backup, holds no secrets; `self uninstall` removes it | The launcher reads the key file at startup and passes the secret to the Claude Code process only. Nothing writes it into the launcher body, a settings file, or your shell history. Set `CLAUDE_CONFIG_DIR` before installing to keep the key beside a non-default Claude Code configuration directory, or `KEIRO_BIN_DIR` to write the launcher somewhere other than `~/.local/bin`. ## Manage the setup The launcher carries a `self` namespace for local management, so removal never requires re-fetching the installer: ```bash claude-keiro self status # show what the setup manages claude-keiro self uninstall # remove the launcher and helper claude-keiro self help # list these commands ``` `self status` lists the launcher, helper, and key-file paths and whether each is present, plus the helper log locations and whether `claude-keiro` resolves on your `PATH`. The key file's contents are never shown. `self uninstall` removes the launcher, its `keiro-claude` alias, the model picker helper, and the helper logs. The key file is never deleted: the command prints the exact `rm` line to run yourself if you also want the stored secret gone. Plain `claude` is never changed. ## Set up without the installer The launcher only sets documented Claude Code environment variables. Pass the same set yourself, scoped to the one command so nothing lingers in your shell: ```bash KEIRO_BASE_URL=https://api.keirolabs.ai/v1 ANTHROPIC_BASE_URL="${KEIRO_BASE_URL%/v1}" \ ANTHROPIC_AUTH_TOKEN="$(cat ~/.claude/keiro-api-key)" \ ANTHROPIC_MODEL="eb1-preview" \ ANTHROPIC_DEFAULT_OPUS_MODEL="eb1-preview" \ ANTHROPIC_DEFAULT_SONNET_MODEL="eb1-efficient-preview" \ ANTHROPIC_DEFAULT_HAIKU_MODEL="eb1-fast-preview" \ ANTHROPIC_DEFAULT_FABLE_MODEL="eb1-frontier-preview" \ CLAUDE_CODE_SUBAGENT_MODEL="eb1-efficient-preview" \ claude ``` Keep the secret in a file only you can read and pass it in at launch, as above. The path is yours to choose; the installer uses `~/.claude/keiro-api-key` with mode `0600`. Do not put the secret in a shell startup file. This path runs without the local helper, so the `/model` picker does not list eb1 rows; the tier variables above still pin every tier to an eb1 model. `ANTHROPIC_BASE_URL` is the API root without the `/v1` suffix. Claude Code appends `/v1/messages` itself, so a value that already ends in `/v1` produces a `404`. `ANTHROPIC_AUTH_TOKEN` is sent as `Authorization: Bearer`, the same credential form as every other public endpoint. See [API auth](api-auth.md). ## Client limitations Claude Code reserves some of its interface for its own endpoint. These limits come from the client, not from Keiro: - The `/model` picker shows no pricing and no reasoning-effort control for eb1 models. Pick the variant that fits the task and read cost in Keiro Usage instead. - `/fast` and Remote Control are unavailable while `ANTHROPIC_BASE_URL` points at Keiro. - Extended thinking is not shown in the transcript. Answers arrive complete; only the intermediate display is missing. ## Rotate the Claude Code key 1. Create a replacement dedicated key in the console. 2. Remove the old local key file. 3. Run the installer again and enter the replacement secret at the prompt. 4. Launch `claude-keiro` and verify a harmless request. 5. Delete the old key in the console. Do not pass the secret in a command argument or save it in shell history. ## Remove the setup Setup owns exactly the files in the table above; the stock `claude` command and `~/.claude/settings.json` are never touched. The launcher removes its own artifacts: ```bash claude-keiro self uninstall ``` This deletes the launcher, its `keiro-claude` alias, the model picker helper, and the helper logs, wherever `CLAUDE_CONFIG_DIR` or `KEIRO_BIN_DIR` put them. The key file survives; the command prints the exact `rm` line to delete it too. If the launcher itself is already gone, remove the remaining files by hand: ```bash rm -f ~/.local/bin/claude-keiro ~/.local/bin/keiro-claude ~/.claude/keiro-shim.py ~/.claude/keiro-shim.log ~/.claude/keiro-shim.log.1 ~/.claude/keiro-shim-diag.log ~/.claude/keiro-api-key ``` Delete the key in [API keys](https://console.keirolabs.ai/api-keys) once nothing else uses it. ## Troubleshooting The installer's last line is its verdict. `Done.` after a `Verified against` line means the stored key answered an authenticated request during the run. `Done (key stored, not verified)` means the files are in place but the check could not run — the API was unreachable or `curl` is missing — so the first launch is where an invalid key would surface. `Setup incomplete: no API key stored.` with a nonzero exit means the run stored nothing; use the printed store command or `--key-file`, then rerun the installer. `claude-keiro: missing key file` means setup did not store a key. Run the installer from an interactive terminal and enter an active key, or rerun it with `--key-file`. `command not found: claude-keiro` means the launcher directory is not on your `PATH`. The installer names the directory and the launcher's full path; it does not edit shell startup files for you. At startup Claude Code may print a notice that claude.ai connectors are disabled. The message comes from the Claude Code client, which shows it for any non-default endpoint; it is informational and requests to Keiro are unaffected. If the `/model` picker shows only the stock tier names, `python3` was not found at launch, or the helper failed to start — its startup errors print to the terminal. Install python3 and start `claude-keiro` again. If `claude` is still missing after setup, install it with npm and run the Keiro installer again. A `401` means the stored key is missing, invalid, or revoked. A model error means the selected model is not enabled for that key. Check the console's API Keys and Models pages before retrying. To find the request id for a specific response, read `~/.claude/keiro-shim.log`: the helper writes one line per request with the timestamp, method, path, model, request id, and HTTP status, rotating the file near 1 MB with the previous portion kept in `~/.claude/keiro-shim.log.1`. The helper never writes to the terminal while Claude Code runs; after a session with failed requests, `claude-keiro` prints how many there were and points at the log. Include the request id when contacting support about a response. ## Related pages - [Agent-driven setup](agent-setup.md) - [API keys](api-keys.md) - [API auth](api-auth.md) - [Models](models.md) - [Messages API](messages.md) - [Usage and billing](usage-billing.md) - [Claude Code gateway documentation](https://code.claude.com/docs/en/llm-gateway)