Accounts

Snapshot native provider logins so several can coexist and any client can use them.

An account is a login that some provider’s own CLI created. AnyPick snapshots it, so you can keep several, switch between them, and lend one to a client that was never designed to use it.

Supported providers

Provider	Live auth	How other clients reach it
`claude`	Claude Code Keychain / `~/.claude/.credentials.json`	direct, for Claude Code only
`codex`	`~/.codex/auth.json`	direct, for Codex only
`grok`	`~/.grok/auth.json`	built-in dual proxy (OpenAI + Anthropic)
`opencode`	OpenCode auth store	built-in Zen/Go dual proxy
`gemini`	`~/.gemini/` (`.env`, oauth, accounts)	built-in dual proxy → Gemini API
`kiro`	kiro-cli secret store, `~/.aws/sso/cache`, or an API key you supply	external `kirolink` / `kiro-proxy`, if installed

anypick providers prints the same table with live status for your machine.

AnyPick does not implement provider login flows; it reads what the native tool produced. Two ways in:

claude login
anypick add account claude --current --name personal

codex login
anypick add account codex --current --name personal

The credential that is live right now becomes a saved snapshot named codex/personal.

anypick add account codex --new --name work

AnyPick stashes the live credential and clears it, so the provider CLI offers a login prompt instead of reusing the existing session. Log in, and AnyPick saves the result under the new name.

For Gemini, --source gemini-cli|antigravity picks which sign-in to read when both exist.

Kiro also accepts a key you already hold:

anypick add account kiro --api-key --name team      # prompts for the key
anypick add account kiro --api-key ksk_… --region us-east-1 --name team

Omit the value and AnyPick prompts for it, so the key never enters your shell history. --region is checked when the account is saved rather than when its proxy starts, because a region that looks plausible but is wrong produces an account that starts and then fails every request.

In the terminal UI the same flow is Use an API key instead on the add-account screen. It is offered even when nothing is signed in. The key, the region and the name are one form: tab moves between them, the key is hidden as you type it, and the region keeps its known values under the arrow keys while staying editable for one this build has not heard of.

A key is not a login on this machine: it is stored only in AnyPick, so it never shows as the live Kiro credential, activating it leaves any kiro-cli login on disk untouched, and account refresh will not overwrite it. Clients reach it exactly like any other Kiro account — through kirolink, which the account’s proxy starts in API-key mode.

Using an account

anypick use codex --with codex/personal    # same-protocol: direct
anypick use claude --with grok/work        # cross-protocol: proxy starts on demand
anypick run claude

When the client and the account speak different protocols, AnyPick starts a local translating proxy and points the client at it. You do not start the proxy yourself — see Proxies if you want to.

Managing saved accounts

anypick account list                   # or: anypick list accounts
anypick account refresh codex          # refresh the live login
anypick account refresh codex work     # refresh one saved account
anypick account refresh codex --all    # refresh every saved account
anypick account remove codex old -y

refresh renews OAuth tokens in place. The account keeps its name, so bindings that point at it keep working; nothing needs re-binding. It exits non-zero if any target failed, and prints which one.

Export and import

Move an account to another machine:

anypick account export codex work -o ./work.json
anypick account import codex work -i ./work.json

import refuses to overwrite an existing name unless you pass --force.

Model defaults

When a binding attaches an account proxy to Claude, AnyPick sets the Claude model roles:

ANTHROPIC_MODEL — the default
ANTHROPIC_DEFAULT_SONNET_MODEL, …_OPUS_MODEL, …_HAIKU_MODEL

The values come from the running proxy’s live /v1/models catalog when one is available, so newly released models appear without a AnyPick update. Change them later with m on the Proxy or Gateways board, from Apps by rebuilding the route, or by re-binding with an explicit --model.