Claude Code

​

Prerequisites

• An Openlayer API key and the ID of the inference pipeline that should receive the traces.
• A way to deliver Claude Code managed settings to your developers. Either:
  • Server-managed settings, from the claude.ai admin console. Requires Claude for Teams or Claude for Enterprise and the Owner or Primary Owner role.
  • Endpoint-managed settings, deployed to each device through MDM, an OS policy, or a managed-settings.json file.
• Claude Code v2.1.251 or later on developer machines. Earlier versions don’t fully lock the export destination described in What developers can and can’t change.

​

How Claude Code tracing works

claude_code.interaction
├── claude_code.llm_request
└── claude_code.tool
    ├── claude_code.tool.blocked_on_user
    └── claude_code.tool.execution

​

1. Write the managed settings

{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "CLAUDE_CODE_ENHANCED_TELEMETRY_BETA": "1",
    "OTEL_TRACES_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL": "http/protobuf",
    "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT": "https://api.openlayer.com/v1/otel/v1/traces",
    "OTEL_EXPORTER_OTLP_TRACES_HEADERS": "Authorization=Bearer YOUR_OPENLAYER_API_KEY,x-bt-parent=pipeline_id:YOUR_OPENLAYER_PIPELINE_ID",
    "OTEL_LOG_USER_PROMPTS": "0",
    "OTEL_LOG_TOOL_DETAILS": "0",
    "OTEL_LOG_TOOL_CONTENT": "0"
  }
}

• OTEL_EXPORTER_OTLP_TRACES_* scopes the endpoint, protocol, and credentials to traces. If your organization already exports Claude Code metrics or logs to another collector, that export keeps working, and your Openlayer API key is never sent to it.
• The endpoint is the full traces path, because a traces-specific variable doesn’t have /v1/traces appended to it.
• The x-bt-parent header chooses the inference pipeline that receives the traces.
• The three OTEL_LOG_* values keep content redacted and stop individual developers from turning content capture on in their own settings. Remove them only if you deliberately opt in.

​

2. Deliver the managed settings

​

3. Verify the export

1. On a developer’s machine, start Claude Code and run /status. The Setting sources line should list Enterprise managed settings with the source you used: (remote) for the admin console, (plist) or (HKLM) for MDM, and (file) or (drop-ins) for a managed settings file.
2. If you used the admin console, run claude doctor and check the Managed settings (remote) line. It says whether the settings loaded, the fetch failed, or Claude Code skipped it and why.
3. Send a prompt in Claude Code. Within a few seconds, a trace appears in your Openlayer inference pipeline, with the claude_code.interaction span at its root.

claude --debug-file /tmp/claude-otel.log
grep "3P telemetry" /tmp/claude-otel.log

​

What developers can and can’t change

• The destination is locked. Because managed settings set the traces endpoint and credentials, Claude Code removes any traces endpoint a developer sets in their shell or user settings at startup, including BETA_TRACING_ENDPOINT, and logs a warning in the debug log.
• Tracing can’t be turned off. The enable flags and OTEL_TRACES_EXPORTER are managed, so a developer can’t set the exporter to none or console, or disable telemetry.
• Repositories can’t change it. Claude Code ignores OpenTelemetry variables in a repository’s .claude/settings.json and .claude/settings.local.json.
• Content stays redacted. A developer can’t set the OTEL_LOG_* values to 1 for their own sessions.

​

Privacy and data handling

​

Capture Claude’s replies with detailed tracing

{
  "env": {
    "ENABLE_BETA_TRACING_DETAILED": "1",
    "BETA_TRACING_ENDPOINT": "https://api.openlayer.com/v1/otel",
    "OTEL_LOG_USER_PROMPTS": "1"
  }
}

• BETA_TRACING_ENDPOINT is a base URL. Claude Code appends /v1/traces to it and sends traces there instead of to OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. It still sends the OTEL_EXPORTER_OTLP_TRACES_HEADERS credentials.
• OTEL_LOG_USER_PROMPTS gates the prompt and reply text. Without it, detailed traces still arrive, but each trace’s input and output are empty.
• Detailed tracing doesn’t use otelHeadersHelper. Set the credentials in OTEL_EXPORTER_OTLP_TRACES_HEADERS.
• Claude Code also sends logs to /v1/logs under the same base URL. Openlayer doesn’t ingest logs, so those requests fail and the debug log shows an OTEL diag error for each. Traces are unaffected.

​

Which Claude surfaces are covered

• Claude Code OTLP export (this page) works on Claude for Teams and Claude for Enterprise. Claude Code pushes traces to Openlayer as each developer works.
• Claude Compliance requires Claude for Enterprise. Openlayer pulls transcripts of claude.ai chats, Cowork sessions, and Claude Code sessions from Anthropic’s Compliance API on a schedule.

​

Rotate the API key with a headers helper

{
  "otelHeadersHelper": "/usr/local/bin/openlayer-otel-headers.sh",
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "CLAUDE_CODE_ENHANCED_TELEMETRY_BETA": "1",
    "OTEL_TRACES_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL": "http/protobuf",
    "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT": "https://api.openlayer.com/v1/otel/v1/traces"
  }
}

#!/bin/bash
echo "{\"Authorization\": \"Bearer $(get-openlayer-key)\", \"x-bt-parent\": \"pipeline_id:YOUR_OPENLAYER_PIPELINE_ID\"}"

​

Troubleshooting