anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #2405] feat(apikey): Allow apikeys loaded from commands #10299

New Issue
Closed
opened 2026-02-16 18:14:55 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:14:55 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/2405

State: closed
Merged: No

Heyo, hopefully you don't consider this new functionality, but feel free to reject if you have another plan. Still, I'm filing this under either "fixes for env specific quirks" (this enables environments that load secrets differently) or "missing standard behavior" (some tools that also use api keys already provide this (or similar methods) for loading secrets).

The big thing this partially/kinda helps protect against is rogue users skimming keys. For security reasons, many users avoid leaving secrets in plain text or even environment variables. Some tooling will allow reading secrets from a command instead. For example, gp.nvim's instructions for password managers, or CodeCompanion's "cmd:" prefix

The main change here is to allow api keys to (also) be loaded from the output of a command. auth.json would allow for a new "type" of apikey: cmd, with the value saved as an array (command plus args). The opencode auth login command is also updated to now let you users pick whether to paste just a key, or use the new command format.

Here's what it looks like:

  • Configure opencode provider (opencode auth login and when it's time for the key, choose to enter a command instead.
  • The 1password command I use is op read "op://some vault/some key/password". See their docs.
  • The value saved for the provider in ~/.local/share/opencode/auth.json is saved as an array: ['op', 'read', "op://some vault/some key/password"] (with type "cmd")
  • When I start opencode, if 1password is currently locked I'm prompted to unlock. Once unlocked, if my 1password has access to that key path, then the key is handed to opencode for that session.
  • If I shut down and lock my system, then I'll have to re-auth again the next time I try to load that value
**Original Pull Request:** https://github.com/anomalyco/opencode/pull/2405 **State:** closed **Merged:** No --- Heyo, hopefully you don't consider this new functionality, but feel free to reject if you have another plan. Still, I'm filing this under either "fixes for env specific quirks" (this enables environments that load secrets differently) or "missing standard behavior" (some tools that also use api keys already provide this (or similar methods) for loading secrets). The big thing this partially/kinda helps protect against is rogue users skimming keys. For security reasons, many users avoid leaving secrets in plain text or even environment variables. Some tooling will allow reading secrets from a command instead. For example, [gp.nvim's instructions for password managers](https://github.com/Robitx/gp.nvim?tab=readme-ov-file), or [CodeCompanion's "cmd:" prefix](https://codecompanion.olimorris.dev/configuration/adapters.html#setting-an-api-key) **The main change here is to allow api keys to (also) be loaded from the output of a command.** `auth.json` would allow for a new "type" of apikey: `cmd`, with the value saved as an array (command plus args). The `opencode auth login` command is also updated to now let you users pick whether to paste just a key, or use the new command format. Here's what it looks like: - Configure opencode provider (`opencode auth login` and when it's time for the key, choose to enter a command instead. - The 1password command I use is `op read "op://some vault/some key/password"`. [See their docs.](https://developer.1password.com/docs/cli/reference/commands/read/) - The value saved for the provider in `~/.local/share/opencode/auth.json` is saved as an array: `['op', 'read', "op://some vault/some key/password"]` (with type "cmd") - When I start opencode, if 1password is currently locked I'm prompted to unlock. Once unlocked, if my 1password has access to that key path, then the key is handed to opencode for that session. - If I shut down and lock my system, then I'll have to re-auth again the next time I try to load that value
yindo added the pull-request label 2026-02-16 18:14:55 -05:00
yindo closed this issue 2026-02-16 18:14:55 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#10299
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?