Skip to main content

Cloud Providers

These variables point Claude Code at a cloud provider instead of the Anthropic API. Switch a provider on with a CLAUDE_CODE_USE_* variable. Then set the region, credentials, and endpoints for it. They also cover LLM gateways that sit in front of a provider.

This page lists 78 variables. Set CLAUDE_CODE_USE_BEDROCK, CLAUDE_CODE_USE_VERTEX, or the Foundry switch to 1. Then set region, project, and endpoint variables. To turn one off, unset the CLAUDE_CODE_USE_* variable. You can override a stale shell export with an empty string in settings.json env.

Example​

~/.claude/settings.json
{
"$schema": "https://clawdipedia.cc/schemas/claude-code-settings.json",
"env": {
"CLAUDE_CODE_USE_BEDROCK": "1",
"AWS_REGION": "us-east-1"
}
}

Claude Code now talks to Amazon Bedrock in us-east-1.

Variables​

The table is sorted by name. See Environment Variables for what each column and badge means.

VariableStatusWhat it doesValues and defaultNotes
ANTHROPIC_AWS_BASE_URL
Documented: An official docs page names this item.
Overrides the Claude Platform on AWS endpoint URL.Text. A set value also changes first-party checks for this providerProvider anthropicAws. Not set from project env before trust
ANTHROPIC_AWS_WORKSPACE_ID
Documented: An official docs page names this item.
Gives the workspace ID for Claude Platform on AWS. Claude Code shows it as Workspace ID and passes workspaceId to the AWS client.Text, headers by default. The client gets workspaceId only when this var is set and an anthropic-workspace-id header exists in the default headers. Header source not tracedProvider anthropicAws. Not set from project env before trust
ANTHROPIC_BEDROCK_BASE_URL
Documented: An official docs page names this item.
Overrides the Amazon Bedrock endpoint URL.Text. Defaults are https://bedrock-runtime.<region>.amazonaws.com for requests and https://bedrock.<region>.amazonaws.com for the control planeProvider bedrock. Not set from project env before trust
ANTHROPIC_BEDROCK_MANTLE_BASE_URL
Documented: An official docs page names this item.
Overrides the Amazon Bedrock Mantle endpoint URL.Text. Default is https://bedrock-mantle.<region>.api.awsProvider mantle. Not set from project env before trust
ANTHROPIC_BEDROCK_REGION_PREFIX
Documented: An official docs page names this item.
Sets the cross-region inference profile prefix that Claude Code tries first. Ignored in us-gov- regions.One of us, eu, apac, jp, au, or global. Claude Code rejects any other value. Without it, Claude Code derives us, eu, apac, or global from the AWS region. Claude Code never picks jp and au for youProvider bedrock. Project env can set it before trust
ANTHROPIC_BEDROCK_SERVICE_TIER
Documented: An official docs page names this item.
Sends the value in the X-Amzn-Bedrock-Service-Tier header. The status view shows it as Bedrock service tier.Text. Code does not check the valueProvider bedrock. Project env can set it before trust
ANTHROPIC_FOUNDRY_BASE_URL
Documented: An official docs page names this item.
Sets the full base URL of the Foundry resource.Text. Wins over ANTHROPIC_FOUNDRY_RESOURCE. Without both, the URL is undefinedProvider foundry. Not set from project env before trust
ANTHROPIC_FOUNDRY_RESOURCE
Documented: An official docs page names this item.
Sets the Foundry resource name. Claude Code builds https://<resource>.services.ai.azure.com from it.Text. Claude Code checks it as a resource name. An invalid value with no base URL raises an errorProvider foundry. Not set from project env before trust
ANTHROPIC_GOOGLE_CLOUD_BASE_URL
Undocumented: Only the program shows this item. It can change without notice.
Overrides the endpoint for the Claude Platform on Google Cloud provider.Text. Default is https://claude.googleapis.com. A set value counts as a custom endpoint in first-party checksProvider anthropicGoogleCloud. Not set from project env before trust
ANTHROPIC_GOOGLE_CLOUD_LOCATION
Undocumented: Only the program shows this item. It can change without notice.
Sets the GCP location for the Claude Platform on Google Cloud provider.Text. Claude Code passes it to the client setup. The status view shows global when it is unsetProvider anthropicGoogleCloud. Not set from project env before trust
ANTHROPIC_GOOGLE_CLOUD_PROJECT
Undocumented: Only the program shows this item. It can change without notice.
Sets the GCP project for the Claude Platform on Google Cloud provider.Text. Falls back to GOOGLE_CLOUD_PROJECT in the status view. Also feeds Google auth when no other project var is setProvider anthropicGoogleCloud. Not set from project env before trust
ANTHROPIC_GOOGLE_CLOUD_WORKSPACE_ID
Undocumented: Only the program shows this item. It can change without notice.
Sets the workspace ID for the Claude Platform on Google Cloud provider. The status view shows it.Text. Claude Code passes it to the client setup with the project and locationProvider anthropicGoogleCloud. Not set from project env before trust
ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION
Documented: An official docs page names this item.
Overrides the AWS region for the Haiku-class model on Bedrock.TextProviders bedrock and mantle. Project env can set it before trust
ANTHROPIC_VERTEX_BASE_URL
Documented: An official docs page names this item.
Overrides the Vertex endpoint URL.Text, comes by default. A set value also turns off the default for fine-grained tool streaming on VertexProvider vertex. Not set from project env before trust
ANTHROPIC_VERTEX_PROJECT_ID
Documented: An official docs page names this item.
Sets the GCP project for Vertex requests.Text. It is the last choice after GCLOUD_PROJECT, GOOGLE_CLOUD_PROJECT, and their lowercase formsProvider vertex. Not set from project env before trust
AWS_ACCESS_KEY_ID
Documented: An official docs page names this item.
Gives the standard AWS access key. Claude Code reads it into the Bedrock credential set. It also uses it with the secret key for AWS-based federation.TextProviders bedrock and mantle. Not set from project env before trust
AWS_CONFIG_FILE
Documented: An official docs page names this item.
Gives the standard AWS config file path. Claude Code uses it in the AWS cache key and as an input of the auth refresh check.Text. Key is config file, credentials file, and profile. A host-managed provider check also tests itProviders bedrock and mantle. Not set from project env before trust
AWS_CONTAINER_CREDENTIALS_FULL_URI
Undocumented: Only the program shows this item. It can change without notice.
Gives the standard AWS container credentials URL. Claude Code includes it in the inputs that refresh cached AWS credentials.TextProviders bedrock and mantle. Not set from project env before trust
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
Undocumented: Only the program shows this item. It can change without notice.
Gives the standard AWS container credentials path. Claude Code includes it in the inputs that refresh cached AWS credentials.TextProviders bedrock and mantle. Not set from project env before trust
AWS_DEFAULT_REGION
Documented: An official docs page names this item.
Gives the standard AWS region. It is the fallback for AWS_REGION. Claude Code defaults to us-east-1 when neither is valid.Text. Order is AWS_REGION, then this var, then the shared config, then us-east-1Providers bedrock and mantle. Project env can set it before trust
AWS_ENDPOINT_URL
Documented: An official docs page names this item.
Sets a global AWS endpoint override. Claude Code uses it as a fallback STS URL and counts it as a Bedrock base URL source.Text. Fallback after AWS_ENDPOINT_URL_STS for STS and after the Bedrock-specific names for BedrockBedrock and AWS STS. Not set from project env before trust
AWS_ENDPOINT_URL_BEDROCK
Documented: An official docs page names this item.
Overrides the Bedrock endpoint URL. Claude Code lists it as a Bedrock base URL source for provider checks.Text. In the Bedrock variable list after ANTHROPIC_BEDROCK_BASE_URL and AWS_ENDPOINT_URL_BEDROCK_RUNTIMEBedrock. Not set from project env before trust
AWS_ENDPOINT_URL_BEDROCK_RUNTIME
Documented: An official docs page names this item.
Overrides the Bedrock runtime endpoint URL. Claude Code lists it as a Bedrock base URL source for provider checks.Text. In the Bedrock variable list right after ANTHROPIC_BEDROCK_BASE_URLBedrock. Not set from project env before trust
AWS_ENDPOINT_URL_STS
Undocumented: Only the program shows this item. It can change without notice.
Sets the AWS STS endpoint. Claude Code reads it first, then AWS_ENDPOINT_URL, then https://sts.<region>.amazonaws.com.Text. Also used by the gateway STS role-assume codeBedrock and AWS STS. Not set from project env before trust
AWS_PROFILE
Documented: An official docs page names this item.
Selects the AWS shared config profile for Bedrock credentials and region lookup.Text. Part of the credential fingerprint and of the awsAuthRefresh cache keyBedrock. Project env can set it before trust
AWS_REGION
Documented: An official docs page names this item.
Sets the AWS region for Bedrock. Claude Code reads it first, then AWS_DEFAULT_REGION, then the shared config, then us-east-1.Text. An invalid value gives source env-invalid and falls back to the defaultBedrock. Project env can set it before trust
AWS_ROLE_ARN
Undocumented: Only the program shows this item. It can change without notice.
Gives the role for AWS web identity login. Claude Code also uses it as a credential source marker for Bedrock auth refresh.TextBedrock
AWS_SECRET_ACCESS_KEY
Documented: An official docs page names this item.
Gives the AWS secret key for Bedrock. It pairs with AWS_ACCESS_KEY_ID and AWS_SESSION_TOKEN.Text. Claude Code also writes it into an env object built from a Bedrock access key setupBedrock. Not set from project env before trust
AWS_SESSION_TOKEN
Documented: An official docs page names this item.
Gives the temporary AWS session token that goes with the access key pair for Bedrock.Text. Claude Code also writes it into an env object built from a Bedrock access key setupBedrock. Not set from project env before trust
AWS_SHARED_CREDENTIALS_FILE
Documented: An official docs page names this item.
Sets the path of the AWS shared credentials file for Bedrock.Text. Path string. Part of the credential fingerprint and the awsAuthRefresh cache keyBedrock. Not set from project env before trust
AWS_USE_FIPS_ENDPOINT
Documented: An official docs page names this item.
Selects the FIPS STS endpoint for the gateway role assume code.Text. True only for the exact string trueGateway STS (AWS identity federation)
AWS_WEB_IDENTITY_TOKEN_FILE
Documented: An official docs page names this item.
Gives the path of the web identity token file for AWS role login. Claude Code also uses it as a credential source marker.Text. Path stringBedrock
CLAUDE_CODE_AGENT_PROXY_GH_SHIM
Undocumented: Only the program shows this item. It can change without notice.
Makes the CCR agent proxy write a gh shim onto PATH.On or off. Claude Code sets 1 for the session when the tool config has ghPathShim. A failed write logs a warningClaude Code on the web with agent proxy. Not set from project env before trust
CLAUDE_CODE_AGENT_PROXY_GIT_CONFIG
Undocumented: Only the program shows this item. It can change without notice.
Makes the CCR agent proxy append a governed git config.On or off. Claude Code sets 1 for the session when the tool config has gitConfig. A failed append logs a warningClaude Code on the web with agent proxy. Not set from project env before trust
CLAUDE_CODE_AGENT_PROXY_GIT_HOSTS
Undocumented: Only the program shows this item. It can change without notice.
Lists the governed git hosts for the CCR agent proxy.A comma-separated list, host by default. Claude Code ignores bad entries and logs the count. An empty value gives the default hostClaude Code on the web with agent proxy. Not set from project env before trust
CLAUDE_CODE_AWS_CHAIN_RESOLVE_TIMEOUT_MS
Documented: An official docs page names this item.
Sets how long Claude Code waits for the AWS default credential chain before the request fails.A number of milliseconds, 60000 by default. Whole number from 1 to 2147483647 msBedrock, Mantle, Claude Platform on AWS
CLAUDE_CODE_DISABLE_BEDROCK_CONTENT_TYPE_DEFAULT
Documented: An official docs page names this item.
Stops Claude Code from treating a Bedrock streaming response without Content-Type as application/vnd.amazon.eventstream.On or off. Code sets the header only when the provider is Bedrock and the header is emptyBedrock
CLAUDE_CODE_DISABLE_BEDROCK_CONTENT_TYPE_GUARD
Documented: An official docs page names this item.
Skips the check that a Bedrock stream has the vnd.amazon.eventstream content type.On or off. Without it the request fails and the error names this variableBedrock
CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST
Documented: An official docs page names this item.
Marks that a host app manages provider routing.On or off. Part of a host-managed marker list with ANTHROPIC_UNIX_SOCKET and CLAUDE_CODE_HOST_AUTH_ENV_VAR. Also gates gateway modeHost apps such as Desktop
CLAUDE_CODE_SKIP_ANTHROPIC_AWS_AUTH
Documented: An official docs page names this item.
Skips client-side auth for Claude Platform on AWS, for gateways that sign requests themselves. Claude Code keeps your own Authorization header.On or off. Also skips the AWS credential setup at startup. The status view shows that auth is skippedClaude Platform on AWS. Project env can set it before trust
CLAUDE_CODE_SKIP_ANTHROPIC_GOOGLE_CLOUD_AUTH
Undocumented: Only the program shows this item. It can change without notice.
Skips Google credentials for Claude Platform on Google Cloud. The client runs with skipAuth and keeps your own Authorization header.On or off, Credentials by default. Also skips the Application Default Credentials setup and refresh hintsClaude Platform on Google Cloud. Project env can set it before trust
CLAUDE_CODE_SKIP_AWS_CRED_CACHE
Documented: An official docs page names this item.
Turns off the in-process cache of AWS default-chain credentials. Claude Code then resolves the chain on each API request.On or off. It also skips the credential lookup in the retry checkBedrock and other AWS paths
CLAUDE_CODE_SKIP_BEDROCK_AUTH
Documented: An official docs page names this item.
Skips AWS auth for Amazon Bedrock, for example behind an LLM gateway. Requests use the no-auth scheme.On or off. Also stops the startup credential refresh for BedrockBedrock. Project env can set it before trust
CLAUDE_CODE_SKIP_FOUNDRY_AUTH
Documented: An official docs page names this item.
Skips Azure auth for Microsoft Foundry. Claude Code sends a placeholder token and keeps your own Authorization header.On or off. Ignored when ANTHROPIC_FOUNDRY_AUTH_TOKEN or ANTHROPIC_FOUNDRY_API_KEY is set. Docs note a change in v2.1.203Microsoft Foundry. Project env can set it before trust
CLAUDE_CODE_SKIP_MANTLE_AUTH
Documented: An official docs page names this item.
Skips AWS auth for Amazon Bedrock Mantle, for example behind an LLM gateway. Claude Code keeps your own Authorization header.On or off. Claude Code reads an AWS_BEARER_TOKEN_BEDROCK value first. Also skips the startup credential refreshBedrock Mantle. Project env can set it before trust
CLAUDE_CODE_SKIP_MODEL_ACCESS_MEMORY
Documented: An official docs page names this item.
Turns off the saved memory of models the startup checks found your account cannot invoke on Bedrock and Vertex.On or off. When set, Claude Code does not build the key for the saved file, so it reads and writes nothingBedrock and Vertex startup model checks
CLAUDE_CODE_SKIP_VERTEX_AUTH
Documented: An official docs page names this item.
Skips Google auth for Google Cloud Agent Platform (Vertex), for example behind an LLM gateway.On or off. The Google auth builder gets the skip kind. Also stops the startup credential refreshVertex. Project env can set it before trust
CLAUDE_CODE_USE_ANTHROPIC_AWS
Documented: An official docs page names this item.
Selects Claude Platform on AWS as the provider.On or off. Provider order: gateway, Bedrock, Foundry, this, Google Cloud, Mantle, Vertex. Allowed in project env before trustClaude Platform on AWS
CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD
Undocumented: Only the program shows this item. It can change without notice.
Selects the Anthropic Google Cloud provider. Docs have no row for it. Auth errors are handled like Vertex.On or off. Provider order puts it after Claude Platform on AWS. Allowed in project env before trustAnthropic Google Cloud provider
CLAUDE_CODE_USE_BEDROCK
Documented: An official docs page names this item.
Selects Amazon Bedrock as the provider.On or off. Wins over Foundry, Vertex, and others. With CLAUDE_CODE_USE_MANTLE it routes anthropic.* models to MantleAmazon Bedrock
CLAUDE_CODE_USE_FOUNDRY
Documented: An official docs page names this item.
Selects Microsoft Foundry as the provider.On or off. Wins over Claude Platform on AWS, Vertex, and Mantle. Allowed in project env before trustMicrosoft Foundry
CLAUDE_CODE_USE_GATEWAY
Undocumented: Only the program shows this item. It can change without notice.
Marks a host-managed gateway session. Claude Code needs ANTHROPIC_BASE_URL and a token. Without them, it warns and ignores the flag.On or off. Needs ANTHROPIC_AUTH_TOKEN or a descriptor token. Some paths also need CLAUDE_CODE_PROVIDER_MANAGED_BY_HOSTDesktop and host-managed gateway
CLAUDE_CODE_USE_MANTLE
Documented: An official docs page names this item.
Selects the Amazon Bedrock Mantle endpoint.On or off. With Bedrock on, anthropic.* model ids route to Mantle. Allowed in project env before trustAmazon Bedrock Mantle
CLAUDE_CODE_USE_VERTEX
Documented: An official docs page names this item.
Selects Google Cloud's Agent Platform (Vertex) as the provider.On or off. Last in the provider order before first party. Allowed in project env before trustGoogle Vertex
CLAUDE_GATEWAY_ALLOW_LOOPBACK
Documented: An official docs page names this item.
Lets the gateway server reach loopback addresses. Otherwise it blocks them as SSRF.On or off. The error text says to set 1 in the gateway environmentclaude gateway server
CLAUDE_GATEWAY_DRAIN_TIMEOUT_MS
Documented: An official docs page names this item.
Sets how long open requests may finish after a shutdown signal.A number of milliseconds, 25000 by default. Plain digits 1 to 2147000000claude gateway server
CLAUDE_GATEWAY_LOG_LEVEL
Documented: An official docs page names this item.
Sets the log level of the gateway server.info by default. debug, info, warn, or error, any caseclaude gateway server
CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY
Documented: An official docs page names this item.
Treats the forward proxy as the egress boundary. The gateway passes hostnames and does not resolve them itself.On or off. Needs HTTPS_PROXY or HTTP_PROXY and no NO_PROXY. Warns when it clashes with CLAUDE_GATEWAY_ALLOW_LOOPBACKclaude gateway server
CLOUD_ML_REGION
Documented: An official docs page names this item.
Sets the Vertex AI region.--
CLOUDSDK_ACTIVE_CONFIG_NAME
Undocumented: Only the program shows this item. It can change without notice.
Picks the active gcloud config name. Claude Code reads it to find the GCP project and account.Text-
CLOUDSDK_AUTH_ACCESS_TOKEN
Undocumented: Only the program shows this item. It can change without notice.
Gives a gcloud access token. Its presence counts as a cloud credential for provider checks.Text (a secret)-
CLOUDSDK_CONFIG
Undocumented: Only the program shows this item. It can change without notice.
Sets the gcloud config directory that Claude Code reads.--
GCLOUD_PROJECT
Documented: An official docs page names this item.
Gives the Google Cloud project id for Vertex AI. It is the first choice.Text. Order is GCLOUD_PROJECT, GOOGLE_CLOUD_PROJECT, lowercase forms, then ANTHROPIC_VERTEX_PROJECT_IDVertex. Not set from project env before trust
gcloud_project
Undocumented: Only the program shows this item. It can change without notice.
Gives the lowercase GCP project id. It is a fallback after the uppercase names for the Vertex project.Text. Non-empty string. Order: GCLOUD_PROJECT, GOOGLE_CLOUD_PROJECT, this, google_cloud_project, then ANTHROPIC_VERTEX_PROJECT_IDVertex AI
GOOGLE_APPLICATION_CREDENTIALS
Documented: An official docs page names this item.
Gives the path of the Google credentials file. Claude Code uses it for Vertex auth, and the Google auth library also uses it.Text. Lowercase form is also read. Part of the Vertex client cache keyVertex. Not set from project env before trust
google_application_credentials
Undocumented: Only the program shows this item. It can change without notice.
Gives the lowercase GCP credentials path. It is a fallback after GOOGLE_APPLICATION_CREDENTIALS.Text. Non-empty stringVertex AI
GOOGLE_CLOUD_PROJECT
Documented: An official docs page names this item.
Gives the Google Cloud project id for Vertex AI. It comes after GCLOUD_PROJECT.Text. Lowercase form is also read. Also passed to the Google Cloud clientVertex. Not set from project env before trust
google_cloud_project
Undocumented: Only the program shows this item. It can change without notice.
Gives the lowercase GCP project id. It is a fallback in the Vertex project lookup.Text. Non-empty string. Order: GCLOUD_PROJECT, GOOGLE_CLOUD_PROJECT, gcloud_project, then thisVertex AI
GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES
Undocumented: Only the program shows this item. It can change without notice.
Must be 1 to let Google pluggable auth run an executable.Other values throw an errorGoogle auth library
GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE
Undocumented: Only the program shows this item. It can change without notice.
The Google auth library sets it in the env of a pluggable auth executable. It holds the audience.-Google auth library
GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL
Undocumented: Only the program shows this item. It can change without notice.
The Google auth library sets it in the env of a pluggable auth executable when it impersonates a service account.-Google auth library
GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE
Undocumented: Only the program shows this item. It can change without notice.
The Google auth library sets it to 0 in the env of a pluggable auth executable.-Google auth library
GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE
Undocumented: Only the program shows this item. It can change without notice.
The Google auth library sets it in the env of a pluggable auth executable when an output file is set.A pathGoogle auth library
GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE
Undocumented: Only the program shows this item. It can change without notice.
The Google auth library sets it in the env of a pluggable auth executable. It holds the subject token type.-Google auth library
K_CONFIGURATION
Undocumented: Only the program shows this item. It can change without notice.
Detects Google Cloud Run jobs and services in the bundled Google auth library.--
K_SERVICE
Undocumented: Only the program shows this item. It can change without notice.
Detects Google Cloud Run in the bundled Google auth library and in Claude Code's environment report.--
METADATA_SERVER_DETECTION
Undocumented: Only the program shows this item. It can change without notice.
Controls how the bundled Google auth library detects the GCE metadata server.--
VERTEX_REGION_CLAUDE_*
Undocumented: Only the program shows this item. It can change without notice.
Sets the Google Cloud region for one model family. One variable exists for each suffix.Text. The first table entry whose model prefix matches the model id wins, then CLOUD_ML_REGION, then us-east5Google Cloud Agent Platform (CLAUDE_CODE_USE_VERTEX)

How It Works​

Claude Code picks one provider when it starts. The provider decides which auth path, endpoint, and model IDs it uses. If a shell profile exports a provider switch you cannot remove, set it to an empty string in the env block. Claude Code treats an empty value as unset for provider selection.

Source: the program (variable names found in the 2.1.312 binary) and the Environment Variables page of the official docs.