claudio

CLI wrapper for Claude Code that lets you switch between projects with different API keys (or other env vars) before launching claude and retrieving them from 1Password, before launching claude.

The Problem

When working for multiple clients, you often need to switch between different Anthropic API keys. Claude Code doesn't provide a way to select a named project configuration at launch — you'd have to manually update your config or environment before each session.

On top of that, storing API keys as plaintext in config files is a supply chain risk.

This Solution

claudio lets you define named project profiles, each with their own env vars. At launch you pick a project and its env is merged into your Claude config for that session. API keys are stored securely in 1Password and resolved at runtime — never written to disk in plaintext.

Claude Code also supports apiKeyHelper — a shell command that returns an API key at runtime, so you can pull it from 1Password yourself:

{ "apiKeyHelper": "op read op://Personal/Anthropic/credential" }

This works well for a single key per machine, but it can't be combined with an auth token. claudio adds value when you manage multiple clients with different keys or need per-project env vars beyond just the API key.

Prerequisites

• Mac/Linux: homebrew package manager (run once ever):

  brew tap iodigital-com/io

  brew trust --tap iodigital-com/io

  (or) uv package manager

• Windows: uv package manager

Installation

Mac/Linux

1. brew install claudio
2. Run claudio anywhere

Windows

1. Clone the repo
2. Run uv tool install . --reinstall from the repo root
3. Run claudio anywhere

Usage

# Launch with project selection
claudio

# Pass arguments through to claude
claudio --model claude-4-5-sonnet -p "hello"

# Help
claudio --help

When you run claudio:

1. It discovers your claudio config (highest precedence wins).
2. If there's only one project, it's selected automatically.
3. Otherwise you're prompted to pick one (the last-used project is the default).
4. The selected project's env is retrieved from 1Password and merged into your Claude config.
5. claude is launched with any extra CLI arguments you passed.

If no claudio config exists, claude is launched directly. Note that even though claudio works with API keys specified in the settings files for backward compatibility, the 1Password store is highly preferred.

Configuration

Create a claudio.settings.json (shared) or claudio.settings.local.json (git-ignored, personal) in any of these locations (same hierarchy as Claude Code):

Scope	Path
User	~/.claude/claudio.settings.json
Project	.claude/claudio.settings.json
Project local	.claude/claudio.settings.local.json

Config Schema

• projects — array of project objects:
  • name (string, required) — display name for the project.
  • env (object, optional) — key-value pairs of environment variables. These are merged into the env of the Claude Code config, overriding only the keys you specify. Values starting with op:// are resolved via the 1Password CLI at runtime (see below).

Example config:

{
  "projects": [
    {
      "name": "Customer 1",
      "env": {
        "ANTHROPIC_AUTH_TOKEN": "1Password reference - op://....."
      }
    },
    {
      "name": "Customer 2",
      "env": {
        "ANTHROPIC_AUTH_TOKEN": "sk-..."
      }
    }
  ]
}

Pinning a project per repo

If you always use the same project in a given repo, create a .claude/claudio.settings.local.json in your workspace with a single project:

{
  "projects": [
    {
      "name": "Customer 1",
      "env": {
        "ANTHROPIC_AUTH_TOKEN": "op://....."
      }
    }
  ]
}

Because there's only one project, claudio will select it automatically — no prompt needed.

Storing API keys securely with 1Password

Storing API keys as plaintext in config files is a supply chain risk — if a malicious package or tool reads your filesystem, your keys are exposed. The recommended approach is to store API keys in 1Password and reference them using the op:// URI scheme:

{
  "projects": [
    {
      "name": "Customer 1",
      "env": {
        "ANTHROPIC_AUTH_TOKEN": "op://<vault>/<item>/<attribute>"
      }
    }
  ]
}

You can use different 1Password item types if you want and create your own (password-typed) attributes if you want.

Example1: the default for a "password" type item

"ANTHROPIC_AUTH_TOKEN": "op://Employee/Bonzai API key clientX/password"

Example2: the "password" type with a custom password-type attribute

"ANTHROPIC_AUTH_TOKEN": "op://Employee/Bonzai API keys/clientX"

Example3: the default for a "API Credential" type item

"ANTHROPIC_AUTH_TOKEN": "op://Employee/Bonzai API key ClientX/referentie"

When claudio detects an op:// value, it resolves it via the 1Password CLI (op read) before passing the token to Claude Code. Everyone at iO has access to 1Password, so this is the preferred setup.

You do need to setup 1Password CLI for this, see: https://www.1password.dev/cli/get-started