Use Claude models via GitHub Copilot

/copilot

How to use Claude models through your GitHub Copilot subscription in Claude Code — both the CLI and the IDE — by routing Claude Code at a local copilot-api proxy.

What this does

copilot-api runs a small local proxy that exposes GitHub Copilot's models behind an Anthropic-compatible endpoint. Point Claude Code at that endpoint and it uses Copilot-backed Claude models instead of an Anthropic API key — so your Copilot subscription becomes the auth/billing path. Works for both the claude CLI and the IDE extension.

⚠️ Security-critical — read the "Security" section below before you run anything. This proxy sits in the middle of all your Claude Code traffic and holds your GitHub Copilot credentials. Pin the version; never use @latest. A compromised release would be a top-severity supply-chain attack.

1. Authenticate with Copilot (one-time)

bash

npx @jeffreycao/copilot-api@1.11.2 auth

Logs in to your GitHub Copilot account (device-login flow) and stores the token locally. You only need to do this once per machine. (1.11.2 is the latest at time of writing — pin to a version you have vetted; see "Security" below.)

2. Start the proxy

bash

npx @jeffreycao/copilot-api@1.11.2 start

Starts the local server on http://localhost:4141. Leave it running while you use Claude Code — run it in its own terminal tab or background it.

3. Point Claude Code at the proxy

Set these environment variables so Claude Code talks to the proxy instead of the Anthropic API. In the HM repo they're configured in .claude/settings.json under env, so they're in scope whenever you run claude there:

json

"env": {
  "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1",
  "CLAUDE_FLOW_V3_ENABLED": "true",
  "CLAUDE_FLOW_HOOKS_ENABLED": "true",
  "ANTHROPIC_BASE_URL": "http://localhost:4141",
  "ANTHROPIC_AUTH_TOKEN": "dummy",
  "ANTHROPIC_MODEL": "claude-opus-4.8[1m]",
  "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-5[1m]",
  "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-haiku-4.5",
  "DISABLE_NON_ESSENTIAL_MODEL_CALLS": "1",
  "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
  "CLAUDE_CODE_ATTRIBUTION_HEADER": "0",
  "CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION": "false",
  "CLAUDE_CODE_DISABLE_TERMINAL_TITLE": "true",
  "CLAUDE_PLUGIN_ENABLE_QUESTION_RULES": "true",
  "ENABLE_TOOL_SEARCH": "1"
}

Prefer to set them per-shell (or for a one-off run)? Export them before launching claude:

bash

export ANTHROPIC_BASE_URL=http://localhost:4141
export ANTHROPIC_AUTH_TOKEN=dummy
export ANTHROPIC_MODEL='claude-opus-4.8[1m]'
export ANTHROPIC_DEFAULT_SONNET_MODEL='claude-sonnet-5[1m]'
export ANTHROPIC_DEFAULT_HAIKU_MODEL=claude-haiku-4.5
export DISABLE_NON_ESSENTIAL_MODEL_CALLS=1
export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
export CLAUDE_CODE_ATTRIBUTION_HEADER=0
export CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false
export CLAUDE_CODE_DISABLE_TERMINAL_TITLE=true
export CLAUDE_PLUGIN_ENABLE_QUESTION_RULES=true
export ENABLE_TOOL_SEARCH=1

4. Run Claude Code

CLI: start claude in the repo. With the proxy running and the env vars in scope, every model call routes through Copilot.
IDE: launch the Claude Code IDE / extension from the same environment so it inherits the variables.

How the key variables work

Variable	Purpose
`ANTHROPIC_BASE_URL=http://localhost:4141`	Redirects Claude Code's API calls to the local `copilot-api` proxy.
`ANTHROPIC_AUTH_TOKEN=dummy`	A placeholder — the proxy handles real auth via your Copilot login, so no Anthropic key is needed.
`ANTHROPIC_MODEL` / `…_DEFAULT_SONNET_MODEL` / `…_DEFAULT_HAIKU_MODEL` / `…_SMALL_FAST_MODEL`	Map Claude Code's model tiers to the names Copilot serves (here Opus 4.8 for the main model, Sonnet 5 for the Sonnet tier, and Haiku 4.5 for the Haiku/fast tiers). The `[1m]` suffix on Opus and Sonnet selects the 1M-token context variant; quote the value in the shell because square brackets are glob syntax.
`DISABLE_NON_ESSENTIAL_MODEL_CALLS` / `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC`	Trim background / non-essential calls so you only spend Copilot quota on real work.
`CLAUDE_FLOW_*`, `CLAUDE_PLUGIN_ENABLE_QUESTION_RULES`, `ENABLE_TOOL_SEARCH`, `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS`	Ruflo / Claude Code feature flags kept in scope for the session.

Security: pin the version, vet every upgrade

Why this matters more than a normal dependency. copilot-api is a third-party package (not Anthropic, not GitHub) that you deliberately place in the middle of your AI coding agent's trust path:

It is a man-in-the-middle for every request — it sees all your prompts, your source code, and the model's responses.
It holds your GitHub Copilot credentials (the token from step 1).
It can alter responses — i.e. silently inject backdoored code into what the model returns, which you then review, commit, and ship.

A malicious release could exfiltrate your code, secrets, and Copilot token, or tamper with generated code — silently. Because it is simultaneously a credential store and a response-tampering point inside an autonomous agent, this is an attack vector of the worst kind. It is the same class of incident as the March 2026 LiteLLM PyPI supply-chain compromise, where a popular LLM gateway shipped a credential-stealer in a routine version bump.

@latest is the dangerous part. It means every run auto-pulls whatever the maintainer publishes next — so a single compromised or account-hijacked release lands on your machine, with access to your Copilot token, automatically and unreviewed. Therefore:

✅ Pin to an exact version you have vetted (e.g. @1.11.2) and commit that pin (in this doc, your scripts, and/or a lockfile). Never @latest, never a version range.
✅ Treat every upgrade as a security review, not a routine bump.

Vet every upgrade with Claude before bumping. When a new version appears, don't upgrade blind — have Claude audit it first. For example, ask Claude (in Claude Code):

Audit @jeffreycao/copilot-api@<new-version> before I upgrade from @<current-version>. Download both published tarballs from npm, diff them, and flag anything that doesn't belong in a localhost proxy: new outbound network destinations, pre/post/install scripts, hand-obfuscated or unexpectedly minified code, new dependencies, reads of env vars / ~/.ssh / ~/.config / credential files, or any code that forwards my Copilot token or my prompts/code anywhere other than GitHub's Copilot API. Show me the diff for anything suspicious and tell me whether it's safe to upgrade.

Only move the pin after the audit comes back clean — then re-pin to the new exact version.

Extra hardening (recommended):

Run with --ignore-scripts to neutralize install hooks: npx --ignore-scripts @jeffreycao/copilot-api@1.11.2 start (confirm it still launches).
Run the proxy in a network-egress-restricted sandbox so it can only reach GitHub's Copilot endpoints and localhost.
Periodically check what it actually connects to (lsof / nettop / a firewall like Little Snitch) — it should only talk to GitHub and your loopback.

Keep the proxy from step 2 running — if it stops, calls to localhost:4141 will fail. If you change the proxy port, update ANTHROPIC_BASE_URL to match.