Claude Switch

The problem

Switching Claude Code accounts by hand means signing out and back in. That's slow, and worse, it can wipe the tokens for every MCP server and plugin you've authenticated, because they live in the same Keychain entry as the account itself. Claude Switch keeps each account ready and swaps between them without losing anything else.

How switching works

• Each captured account is stored in its own Keychain item. Names and usage readings go in a small JSON file that holds no secrets.
• Only the account's own OAuth key is swapped. Every other key in Claude Code's credential, including MCP tokens, plugin secrets and anything added in future versions, is carried across unchanged.
• The switch saves the outgoing account first, writes the new one, reads it back and compares. If anything disagrees, the backup is restored.
• The Keychain item is updated in place, never deleted and recreated, so it keeps its access list and Claude Code doesn't prompt on its next start.
• The CLI config is written to a temp file and swapped in atomically, and the app warns when other Claude sessions are running, because a stale session could overwrite it.

Usage at a glance

The menu bar shows the active account's usage, and the panel shows 5-hour, 7-day and per-model limits with reset times. Inactive accounts show their last reading and how old it is. Everything is read locally from Claude Code's own cache, with no network calls. The background refresh never touches the Keychain, so a permission prompt can't appear while you're away.

Built for crowded menu bars

On a 14-inch screen with a dozen background apps, there's often no room for another menu bar item. So the same core powers a CLI: claude-switch ui opens the panel as a window, and list, status, capture and use do the rest from the terminal. In the panel, ⌘1–⌘9 switch accounts, ⌘N captures the current one and ⌘R refreshes.

Decisions worth calling out

• Merge, don't overwrite, so tokens the app doesn't know about survive.
• Sign with a stable local certificate when one exists. The Keychain grant is tied to the code signature, and an ad-hoc signature changes on every build, which would mean a new "Always Allow" prompt each time.
• No automatic rotation when an account hits its limit. That would exist only to get around per-account limits, so it's left out on purpose.
• Logs are redacted. They go to stderr through a filter that strips token-shaped strings.

By the numbers

• 15 Swift files, about 1,750 lines, split across a core library, the app and the CLI
• 32 tests, including end-to-end tests against a throwaway Keychain item
• universal binary for Apple silicon and Intel, macOS 13 and later