Loading an API Key with apiKeyHelper

Hardcoding an API key in a settings file is risky — it can slip into git or get shared by accident. The apiKeyHelper key solves this by pointing at a script that produces the key at runtime, so the key itself never sits in your config.

The setting

The value is the path to a script.

{
  "apiKeyHelper": "/home/you/.claude/get-key.sh"
}

When Claude Code needs the key, it runs that script and reads the key from its output. The key lives wherever the script pulls it from, not in the settings file.

What the script does

The script just needs to print the key. It can fetch it from anywhere you trust:

• A secret manager or vault your team already uses.
• Your OS keychain or credential store.
• An environment variable set outside your project.

A bare-bones example that reads from a secret manager might look like this:

#!/usr/bin/env bash
my-secret-tool read claude/api-key

Make the script executable, and keep it somewhere private — not inside a repo that gets committed.

Why this is safer

Because the key is fetched fresh each time, you get real benefits:

• Nothing sensitive is written into settings.json, so it's safe to commit the rest of your config.
• Rotating the key is easy — update it in one place, the source your script reads.
• Different machines can resolve the key differently while sharing the same setting.

Where to put it

This is a personal, per-machine detail, so your user file, ~/.claude/settings.json, is usually the right home. Keep the helper script and its secret source off git, and your key stays out of your history for good.