BYOK · Keychain · Pro

Claude Code with your own OpenAI key.

Use gpt-4o or gpt-4o-mini through Claude Code, billed against your OpenAI account, with the key locked in macOS Keychain. ToolPiper injects it server-side — your dotfiles, shell history, and screenshots stay clean.

Before you start

  • OpenAI account with API access (an OPENAI_API_KEY at <a href="https://platform.openai.com/api-keys" target="_blank" rel="noopener noreferrer" class="text-primary-400 hover:text-primary-300">platform.openai.com/api-keys</a>).
  • Claude Code installed.
  • ToolPiper installed and ToolPiper Pro activated (cloud-key proxying is a Pro feature).

Setup

  1. 1

    Add your OpenAI key to ToolPiper

    Open ToolPiper → Settings → Cloud Providers → OpenAI → Add Key. Paste the key. ToolPiper stores it in macOS Keychain (encrypted at rest, never written to disk in plaintext) and returns a Keychain reference. The actual key string is never available to JavaScript or to Claude Code.

  2. 2

    Create an OpenAI endpoint

    In ToolPiper → Endpoints → Add Endpoint → OpenAI (cloud). Pick a model — gpt-4o-mini for cheap fast work, gpt-4o for harder tasks. Save. The endpoint references your Keychain key by id, not by value.

  3. 3

    Click "Configure for Claude Code"

    ToolPiper → Docs → Claude Code → Configure for Claude Code. We write ~/.claude/settings.json with a ToolPiper dev token (not your OpenAI key) and add your OpenAI endpoint to Claude Code's /model picker.

  4. 4

    Run Claude Code, pick OpenAI in /model

    Open any terminal.

    shell
    claude
    # /model → "OpenAI gpt-4o-mini (your key)"
    # Every prompt now bills against your OpenAI account.
  5. 5

    Watch the bill from inside Claude Code

    Ask "how much have I spent in this session?" — ToolPiper's LogPiper telemetry surfaces per-session token counts (pre-pricing rollup). For full billing, the OpenAI dashboard is the source of truth.

Why this recipe

Key never leaves Keychain

ToolPiper signs OpenAI requests server-side. Your dotfiles stay free of secrets, screenshots can't leak the key, and Claude Code never sees it.

You own the bill

No marketplace markup, no token routing through us. ToolPiper Pro is a flat subscription; the per-token cost goes straight to OpenAI on your card.

Same flow for any provider

Same recipe works for Anthropic Console, Gemini, Groq, DeepSeek, OpenRouter, Mistral, xAI, and Perplexity. One BYOK pattern; ten providers.

Frequently asked

Why route through ToolPiper instead of pointing Claude Code straight at OpenAI?

Three reasons. (1) Your key stays in Keychain — Claude Code's default flow puts <code class="font-mono text-xs text-white/70">ANTHROPIC_API_KEY</code> in env vars and dotfiles. (2) You can switch providers mid-session ("use my local Qwen") without restarting. (3) ToolPiper's 147 MCP tools come along for free.

Does this work with Anthropic Claude API too?

Yes. Same recipe, but pick <strong>Anthropic (cloud)</strong> as the endpoint provider. Your Anthropic API key is BYOK, billed against your console account. Claude Code talks to ToolPiper, ToolPiper talks to Anthropic.

Can I limit which models the BYOK key can be used for?

Yes. Configure model-level permissions in ToolPiper → Settings → Cloud Providers. The OpenAI Responses API also supports key-level scoping; combine the two for defense in depth.

What if my OpenAI key gets compromised?

Revoke it on platform.openai.com and update ToolPiper's Keychain reference. No rebuild, no Claude Code restart needed — ToolPiper picks up the new key on the next request. Old key string never existed outside Keychain.

Ready to try it?

ToolPiper is a free download. Configure once and Claude Code routes through your Mac.

Other Claude Code recipes