anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

issues providing bedrock auth #341

New Issue
Closed
opened 2026-02-16 17:26:20 -05:00 by yindo · 35 comments
yindo commented 2026-02-16 17:26:20 -05:00
Owner
Copy Link
Copy Source

Originally created by @reedbender on GitHub (Jun 27, 2025).

Originally assigned to: @thdxr on GitHub.

I have been having issues setting up opencode to use bedrock... I have set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as env variables preloaded in the session by my .zshrc ... this didn't work so i tried to create a profile in ~/.aws/config and the same error occurs. I cannot get opencode to pick up these credentials and properly authenticate me with bedrock, but I hope im doing something stupid. Any tips for what I'm missing...?

Image
Originally created by @reedbender on GitHub (Jun 27, 2025). Originally assigned to: @thdxr on GitHub. I have been having issues setting up opencode to use bedrock... I have set the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` as env variables preloaded in the session by my .zshrc ... this didn't work so i tried to create a profile in ~/.aws/config and the same error occurs. I cannot get opencode to pick up these credentials and properly authenticate me with bedrock, but I hope im doing something stupid. Any tips for what I'm missing...? <img width="1052" alt="Image" src="https://github.com/user-attachments/assets/d8c6aff2-8402-420a-b2c7-d02002286f1a" />
yindo closed this issue 2026-02-16 17:26:20 -05:00
yindo commented 2026-02-16 17:26:20 -05:00
Author
Owner
Copy Link
Copy Source

@sandipwane commented on GitHub (Jun 29, 2025):

To get OpenCode working with AWS Bedrock, I had to explicitly set these environment variables — OpenCode expects them to be present:

# AWS Bedrock setup for OpenCode
alias opencode-bedrock='AWS_PROFILE=default AWS_REGION=us-east-1 opencode'

Note: my AWS credentials were already configured via the AWS CLI, but OpenCode still requires these to be set explicitly for the auth flow to work.

Reference:
https://github.com/sst/opencode/blob/67480e5a1c71a0b65467a724a7b7afa828f93168/packages/opencode/src/cli/cmd/auth.ts#L130

@sandipwane commented on GitHub (Jun 29, 2025): To get OpenCode working with AWS Bedrock, I had to explicitly set these environment variables — OpenCode expects them to be present: ```bash # AWS Bedrock setup for OpenCode alias opencode-bedrock='AWS_PROFILE=default AWS_REGION=us-east-1 opencode' ``` Note: my AWS credentials were already configured via the AWS CLI, but OpenCode still requires these to be set explicitly for the auth flow to work. Reference: https://github.com/sst/opencode/blob/67480e5a1c71a0b65467a724a7b7afa828f93168/packages/opencode/src/cli/cmd/auth.ts#L130
yindo commented 2026-02-16 17:26:20 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Jun 30, 2025):

i pushed a fix for this yesterday - can you try again

@thdxr commented on GitHub (Jun 30, 2025): i pushed a fix for this yesterday - can you try again
yindo commented 2026-02-16 17:26:20 -05:00
Author
Owner
Copy Link
Copy Source

@michaelgmcd commented on GitHub (Jul 1, 2025):

+1 on not being able to get bedrock working. I'll clone and get this running locally tomorrow to debug. Our setup:

  • AWS SSO with AWS_PROFILE set
  • Tried with and without AWS_REGION - we use us-east-1 for everything

Tried some custom opencode.json setups from issues here, no luck. OpenAI "just works" with a key in .env

❯ opencode run hey --print-logs
INFO  2025-07-01T21:09:02 +35ms service=default version=0.1.173 args=run,hey,--print-logs opencode
INFO  2025-07-01T21:09:02 +0ms service=app cwd=/<path> creating
INFO  2025-07-01T21:09:02 +3ms service=app git=/<path> git
INFO  2025-07-01T21:09:02 +1ms service=bus type=storage.write subscribing
INFO  2025-07-01T21:09:02 +0ms service=app name=bus registering service
INFO  2025-07-01T21:09:02 +0ms service=format init
INFO  2025-07-01T21:09:02 +0ms service=bus type=file.edited subscribing
INFO  2025-07-01T21:09:02 +0ms service=config.hooks init
INFO  2025-07-01T21:09:02 +0ms service=bus type=file.edited subscribing
INFO  2025-07-01T21:09:02 +0ms service=bus type=session.idle subscribing
INFO  2025-07-01T21:09:02 +0ms service=app name=lsp registering service
INFO  2025-07-01T21:09:02 +1ms service=lsp initializing
INFO  2025-07-01T21:09:02 +1ms service=app name=file.watcher registering service
INFO  2025-07-01T21:09:02 +4ms service=session id=ses_8382d9fa1ffeWroAGhqIbKVeun version=0.1.173 title=New Session - 2025-07-01T21:09:02.687Z time=[object Object] created
INFO  2025-07-01T21:09:02 +0ms service=app name=session registering service
INFO  2025-07-01T21:09:02 +0ms service=app name=storage registering service
INFO  2025-07-01T21:09:02 +0ms service=storage path=/<path> init
INFO  2025-07-01T21:09:02 +4ms service=bus type=storage.write publishing
INFO  2025-07-01T21:09:02 +0ms service=app name=config registering service
INFO  2025-07-01T21:09:02 +1ms service=config loaded
INFO  2025-07-01T21:09:02 +0ms service=bus type=session.updated publishing

█▀▀█ █▀▀█ █▀▀ █▀▀▄ █▀▀ █▀▀█ █▀▀▄ █▀▀
█░░█ █░░█ █▀▀ █░░█ █░░ █░░█ █░░█ █▀▀
▀▀▀▀ █▀▀▀ ▀▀▀ ▀  ▀ ▀▀▀ ▀▀▀▀ ▀▀▀  ▀▀▀

>  hey

INFO  2025-07-01T21:09:02 +1ms service=app name=provider registering service
INFO  2025-07-01T21:09:02 +2ms service=models.dev refreshing
INFO  2025-07-01T21:09:02 +0ms service=provider init
INFO  2025-07-01T21:09:02 +86ms service=provider providerID=amazon-bedrock found
@  amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0

INFO  2025-07-01T21:09:02 +1ms service=bus type=message.part.updated subscribing
INFO  2025-07-01T21:09:02 +0ms service=session session=ses_8382d9fa1ffeWroAGhqIbKVeun chatting
INFO  2025-07-01T21:09:02 +1ms service=provider providerID=amazon-bedrock modelID=anthropic.claude-sonnet-4-20250514-v1:0 getModel
INFO  2025-07-01T21:09:02 +0ms service=provider status=started providerID=amazon-bedrock getSDK
INFO  2025-07-01T21:09:02 +11ms service=lsp.client id=typescript starting client
INFO  2025-07-01T21:09:02 +0ms service=lsp.client id=typescript sending initialize
INFO  2025-07-01T21:09:02 +29ms service=provider status=completed duration=40 providerID=amazon-bedrock getSDK
INFO  2025-07-01T21:09:02 +0ms service=provider providerID=amazon-bedrock modelID=anthropic.claude-sonnet-4-20250514-v1:0 found
INFO  2025-07-01T21:09:02 +1ms service=session sessionID=ses_8382d9fa1ffeWroAGhqIbKVeun locking
INFO  2025-07-01T21:09:02 +8ms service=bus type=storage.write publishing
INFO  2025-07-01T21:09:02 +0ms service=bus type=message.updated publishing
INFO  2025-07-01T21:09:02 +54ms service=lsp.client initialized
INFO  2025-07-01T21:09:02 +95ms service=lsp.client id=pyright starting client
INFO  2025-07-01T21:09:02 +1ms service=lsp.client id=pyright sending initialize
INFO  2025-07-01T21:09:04 +1958ms service=bus type=storage.write publishing
INFO  2025-07-01T21:09:04 +0ms service=bus type=session.updated publishing
INFO  2025-07-01T21:09:07 +3043ms service=lsp initialized
@michaelgmcd commented on GitHub (Jul 1, 2025): +1 on not being able to get bedrock working. I'll clone and get this running locally tomorrow to debug. Our setup: - AWS SSO with AWS_PROFILE set - Tried with and without AWS_REGION - we use us-east-1 for everything Tried some custom opencode.json setups from issues here, no luck. OpenAI "just works" with a key in .env ``` ❯ opencode run hey --print-logs INFO 2025-07-01T21:09:02 +35ms service=default version=0.1.173 args=run,hey,--print-logs opencode INFO 2025-07-01T21:09:02 +0ms service=app cwd=/<path> creating INFO 2025-07-01T21:09:02 +3ms service=app git=/<path> git INFO 2025-07-01T21:09:02 +1ms service=bus type=storage.write subscribing INFO 2025-07-01T21:09:02 +0ms service=app name=bus registering service INFO 2025-07-01T21:09:02 +0ms service=format init INFO 2025-07-01T21:09:02 +0ms service=bus type=file.edited subscribing INFO 2025-07-01T21:09:02 +0ms service=config.hooks init INFO 2025-07-01T21:09:02 +0ms service=bus type=file.edited subscribing INFO 2025-07-01T21:09:02 +0ms service=bus type=session.idle subscribing INFO 2025-07-01T21:09:02 +0ms service=app name=lsp registering service INFO 2025-07-01T21:09:02 +1ms service=lsp initializing INFO 2025-07-01T21:09:02 +1ms service=app name=file.watcher registering service INFO 2025-07-01T21:09:02 +4ms service=session id=ses_8382d9fa1ffeWroAGhqIbKVeun version=0.1.173 title=New Session - 2025-07-01T21:09:02.687Z time=[object Object] created INFO 2025-07-01T21:09:02 +0ms service=app name=session registering service INFO 2025-07-01T21:09:02 +0ms service=app name=storage registering service INFO 2025-07-01T21:09:02 +0ms service=storage path=/<path> init INFO 2025-07-01T21:09:02 +4ms service=bus type=storage.write publishing INFO 2025-07-01T21:09:02 +0ms service=app name=config registering service INFO 2025-07-01T21:09:02 +1ms service=config loaded INFO 2025-07-01T21:09:02 +0ms service=bus type=session.updated publishing █▀▀█ █▀▀█ █▀▀ █▀▀▄ █▀▀ █▀▀█ █▀▀▄ █▀▀ █░░█ █░░█ █▀▀ █░░█ █░░ █░░█ █░░█ █▀▀ ▀▀▀▀ █▀▀▀ ▀▀▀ ▀ ▀ ▀▀▀ ▀▀▀▀ ▀▀▀ ▀▀▀ > hey INFO 2025-07-01T21:09:02 +1ms service=app name=provider registering service INFO 2025-07-01T21:09:02 +2ms service=models.dev refreshing INFO 2025-07-01T21:09:02 +0ms service=provider init INFO 2025-07-01T21:09:02 +86ms service=provider providerID=amazon-bedrock found @ amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0 INFO 2025-07-01T21:09:02 +1ms service=bus type=message.part.updated subscribing INFO 2025-07-01T21:09:02 +0ms service=session session=ses_8382d9fa1ffeWroAGhqIbKVeun chatting INFO 2025-07-01T21:09:02 +1ms service=provider providerID=amazon-bedrock modelID=anthropic.claude-sonnet-4-20250514-v1:0 getModel INFO 2025-07-01T21:09:02 +0ms service=provider status=started providerID=amazon-bedrock getSDK INFO 2025-07-01T21:09:02 +11ms service=lsp.client id=typescript starting client INFO 2025-07-01T21:09:02 +0ms service=lsp.client id=typescript sending initialize INFO 2025-07-01T21:09:02 +29ms service=provider status=completed duration=40 providerID=amazon-bedrock getSDK INFO 2025-07-01T21:09:02 +0ms service=provider providerID=amazon-bedrock modelID=anthropic.claude-sonnet-4-20250514-v1:0 found INFO 2025-07-01T21:09:02 +1ms service=session sessionID=ses_8382d9fa1ffeWroAGhqIbKVeun locking INFO 2025-07-01T21:09:02 +8ms service=bus type=storage.write publishing INFO 2025-07-01T21:09:02 +0ms service=bus type=message.updated publishing INFO 2025-07-01T21:09:02 +54ms service=lsp.client initialized INFO 2025-07-01T21:09:02 +95ms service=lsp.client id=pyright starting client INFO 2025-07-01T21:09:02 +1ms service=lsp.client id=pyright sending initialize INFO 2025-07-01T21:09:04 +1958ms service=bus type=storage.write publishing INFO 2025-07-01T21:09:04 +0ms service=bus type=session.updated publishing INFO 2025-07-01T21:09:07 +3043ms service=lsp initialized ```
yindo commented 2026-02-16 17:26:20 -05:00
Author
Owner
Copy Link
Copy Source

@michaelgmcd commented on GitHub (Jul 2, 2025):

Seems like an issue with the underlying ai SDK. This works for me:
packages/opencode/src/provider/provider.ts

const credentialsProvider = fromNodeProviderChain()
return {
  autoload: true,
  options: {
    ...(await credentialsProvider()),
    region,
   },
};
@michaelgmcd commented on GitHub (Jul 2, 2025): Seems like an issue with the underlying ai SDK. This works for me: packages/opencode/src/provider/provider.ts ``` const credentialsProvider = fromNodeProviderChain() return { autoload: true, options: { ...(await credentialsProvider()), region, }, }; ```
yindo commented 2026-02-16 17:26:20 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Jul 2, 2025):

i just tried with export AWS_PROFILE=myprofile and it worked - is there any chance you have invalid credentials somewhere like ~/.aws/credentials

@thdxr commented on GitHub (Jul 2, 2025): i just tried with `export AWS_PROFILE=myprofile` and it worked - is there any chance you have invalid credentials somewhere like `~/.aws/credentials`
yindo commented 2026-02-16 17:26:20 -05:00
Author
Owner
Copy Link
Copy Source

@michaelgmcd commented on GitHub (Jul 2, 2025):

Nothing configured elsewhere, SSO only. Is your profile SSO as well?

@michaelgmcd commented on GitHub (Jul 2, 2025): Nothing configured elsewhere, SSO only. Is your profile SSO as well?
yindo commented 2026-02-16 17:26:20 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Jul 2, 2025):

yeah it's sso and i make sure i login before i start opencode and it works

@thdxr commented on GitHub (Jul 2, 2025): yeah it's sso and i make sure i login before i start opencode and it works
yindo commented 2026-02-16 17:26:20 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Jul 2, 2025):

is there anything else aws related in env?

@thdxr commented on GitHub (Jul 2, 2025): is there anything else aws related in env?
yindo commented 2026-02-16 17:26:20 -05:00
Author
Owner
Copy Link
Copy Source

@exanter commented on GitHub (Jul 2, 2025):

trying to use this at work, where we also do sso for aws access. just setting the profile doesn't work, even after I've logged in on the command line. The normal way we have to use it is via vscode, where we put in the start url, etc, and then have to copy the full connect url and run it in the browser where we are logged into aws, and allow Q access. Assuming this isn't a normal flow, guessing that isn't covered yet by opencode? Not sure, still digging. Just wanted to add this as a data point.

@exanter commented on GitHub (Jul 2, 2025): trying to use this at work, where we also do sso for aws access. just setting the profile doesn't work, even after I've logged in on the command line. The normal way we have to use it is via vscode, where we put in the start url, etc, and then have to copy the full connect url and run it in the browser where we are logged into aws, and allow Q access. Assuming this isn't a normal flow, guessing that isn't covered yet by opencode? Not sure, still digging. Just wanted to add this as a data point.
yindo commented 2026-02-16 17:26:20 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Jul 2, 2025):

does aws sts get-caller-identity work?

@thdxr commented on GitHub (Jul 2, 2025): does `aws sts get-caller-identity` work?
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@exanter commented on GitHub (Jul 3, 2025):

It does, and now I think the issue is going to be the it's a different id being used in vscode. get-caller-identity is showing my normal cli logged in user, but we have that alternate login method via vscode. I'll have to find time to do more digging on that. it should be possible to bridge the two.

@exanter commented on GitHub (Jul 3, 2025): It does, and now I think the issue is going to be the it's a different id being used in vscode. get-caller-identity is showing my normal cli logged in user, but we have that alternate login method via vscode. I'll have to find time to do more digging on that. it should be possible to bridge the two.
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@michaelgmcd commented on GitHub (Jul 3, 2025):

Nothing crazy, and the cli works. I've had issues with fromNodeProviderChain in the past. I'll crack a beer over the weekend and take a closer look. AWS isn't giving us any more Sonnet 4 tokens per minute, so Bedrock is pretty useless at this point anyway.

@michaelgmcd commented on GitHub (Jul 3, 2025): Nothing crazy, and the cli works. I've had issues with `fromNodeProviderChain` in the past. I'll crack a beer over the weekend and take a closer look. AWS isn't giving us any more Sonnet 4 tokens per minute, so Bedrock is pretty useless at this point anyway.
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@reedbender commented on GitHub (Jul 6, 2025):

I am able to call aws sts get-caller-identity and get the right auth response, this is also via sso. I have also tried explictly running export AWS_REGION=us-east-1 before opencode auth and it is always the same response...

> opencode auth login

┌  Add credential
│
◇  Select provider
│  Amazon Bedrock
│
●  Amazon bedrock can be configured with standard AWS environment variables like AWS_PROFILE or AWS_ACCESS_KEY_ID
│
└  Done
@reedbender commented on GitHub (Jul 6, 2025): I am able to call `aws sts get-caller-identity` and get the right auth response, this is also via sso. I have also tried explictly running `export AWS_REGION=us-east-1` before opencode auth and it is always the same response... ``` > opencode auth login ┌ Add credential │ ◇ Select provider │ Amazon Bedrock │ ● Amazon bedrock can be configured with standard AWS environment variables like AWS_PROFILE or AWS_ACCESS_KEY_ID │ └ Done ```
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@reedbender commented on GitHub (Jul 6, 2025):

@thdxr echo $AWS_PROFILE also shows the correct AWS profile name so I know it is set for the system, I can run other aws commands.

@reedbender commented on GitHub (Jul 6, 2025): @thdxr `echo $AWS_PROFILE` also shows the correct AWS profile name so I know it is set for the system, I can run other aws commands.
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@superandrew213 commented on GitHub (Jul 7, 2025):

@reedbender for Bedrock you authenticate by setting the env variables. No need to call opencode auth login. You will always get this message.
https://github.com/sst/opencode/blob/a272b58fe988addc5c0d18bbaba2b09fac1d9fef/packages/opencode/src/cli/cmd/auth.ts#L121-L127

Try running the model.

opencode run hi --print-logs --model amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0
@superandrew213 commented on GitHub (Jul 7, 2025): @reedbender for Bedrock you authenticate by setting the env variables. No need to call `opencode auth login`. You will always get this message. https://github.com/sst/opencode/blob/a272b58fe988addc5c0d18bbaba2b09fac1d9fef/packages/opencode/src/cli/cmd/auth.ts#L121-L127 Try running the model. ``` opencode run hi --print-logs --model amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0 ```
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@SamuelNorbury commented on GitHub (Jul 8, 2025):

when I run opencode run hi --print-logs --model amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0 I get:

ERROR 2025-07-08T13:33:13 +4ms service=default name=ResolveMessage message=Cannot find module '/home/samuel/.cache/opencode/node_modules/@aws-sdk/credential-providers' from '/$bunfs/root/opencode' code=ERR_MODULE_NOT_FOUND specifier=/home/samuel/.cache/opencode/node_modules/@aws-sdk/credential-providers referrer=/$bunfs/root/opencode importKind=import-statement fatal
Error: Unexpected error, check log file at  for more details

which makes sense:

[15:33:13] ~ (t480) $ ls ~/.cache/opencode/node_modules/
@ai-sdk/            eventsource-parser/ nanoid/             @standard-schema/   zod-to-json-schema/
.bin/               json-schema/        secure-json-parse/  zod/

EDIT: I ran rm -rf ~/.cache/opencode and it solved itself on the next run🤷

@SamuelNorbury commented on GitHub (Jul 8, 2025): when I run `opencode run hi --print-logs --model amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0` I get: ``` ERROR 2025-07-08T13:33:13 +4ms service=default name=ResolveMessage message=Cannot find module '/home/samuel/.cache/opencode/node_modules/@aws-sdk/credential-providers' from '/$bunfs/root/opencode' code=ERR_MODULE_NOT_FOUND specifier=/home/samuel/.cache/opencode/node_modules/@aws-sdk/credential-providers referrer=/$bunfs/root/opencode importKind=import-statement fatal Error: Unexpected error, check log file at for more details ``` which makes sense: ``` [15:33:13] ~ (t480) $ ls ~/.cache/opencode/node_modules/ @ai-sdk/ eventsource-parser/ nanoid/ @standard-schema/ zod-to-json-schema/ .bin/ json-schema/ secure-json-parse/ zod/ ``` EDIT: I ran `rm -rf ~/.cache/opencode` and it solved itself on the next run🤷
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@exanter commented on GitHub (Jul 8, 2025):

I have managed to duplicate the vscode auth flow, in a script, and have it down to exporting AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN. not AWS_PROFILE tho. still getting denied when trying to run a query. Does it need to be turned into an actual profile?

@exanter commented on GitHub (Jul 8, 2025): I have managed to duplicate the vscode auth flow, in a script, and have it down to exporting AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN. not AWS_PROFILE tho. still getting denied when trying to run a query. Does it need to be turned into an actual profile?
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@guerillagorilla commented on GitHub (Jul 8, 2025):

Had the same issue after exporting $AWS_PROFILE to be the name of the current profile I need, and then testing with something like aws s3 ls --profile=$AWS_PROFILE, opencode still failed to display. Once I deleted rm -rf ~/.cache/opencode as mentioned by @SamuelNorbury then all works and the opencode GUI is displayed.

@guerillagorilla commented on GitHub (Jul 8, 2025): Had the same issue after exporting $AWS_PROFILE to be the name of the current profile I need, and then testing with something like `aws s3 ls --profile=$AWS_PROFILE`, opencode still failed to display. Once I deleted `rm -rf ~/.cache/opencode` as mentioned by @SamuelNorbury then all works and the opencode GUI is displayed.
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@reedbender commented on GitHub (Jul 8, 2025):

I can run opencode run hi --print-logs --model amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0 successfully after logging into my aws profile with sso. I can also verify with echo $AWS_PROFILE that the profile is properly set. But then when I launch opencode with the tui, I can see that bedrock is the selected model but it fails to validate permission to access... even though I'd just demonstrated in the cli that it could auth and connect to the bedrock endpoint

Image Image
@reedbender commented on GitHub (Jul 8, 2025): I can run `opencode run hi --print-logs --model amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0` successfully after logging into my aws profile with sso. I can also verify with `echo $AWS_PROFILE` that the profile is properly set. But then when I launch opencode with the tui, I can see that bedrock is the selected model but it fails to validate permission to access... even though I'd just demonstrated in the cli that it could auth and connect to the bedrock endpoint <img width="1116" height="310" alt="Image" src="https://github.com/user-attachments/assets/a01d2384-7956-42f2-868d-7102b1698540" /> <img width="1269" height="1356" alt="Image" src="https://github.com/user-attachments/assets/f61f75f8-dfa3-4308-8afc-033aac69d9f8" />
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@reedbender commented on GitHub (Jul 8, 2025):

@reedbender for Bedrock you authenticate by setting the env variables. No need to call opencode auth login. You will always get this message.

opencode/packages/opencode/src/cli/cmd/auth.ts

Lines 121 to 127 in a272b58

if (provider === "amazon-bedrock") {
prompts.log.info(
"Amazon bedrock can be configured with standard AWS environment variables like AWS_PROFILE or AWS_ACCESS_KEY_ID",
)
prompts.outro("Done")
return
}
Try running the model.

opencode run hi --print-logs --model amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0

Thanks for this suggestion @superandrew213, it was useful to see at least that my aws sso is at least recognized by opencode and the model endpoint can be reached

@reedbender commented on GitHub (Jul 8, 2025): > [@reedbender](https://github.com/reedbender) for Bedrock you authenticate by setting the env variables. No need to call `opencode auth login`. You will always get this message. > > [opencode/packages/opencode/src/cli/cmd/auth.ts](https://github.com/sst/opencode/blob/a272b58fe988addc5c0d18bbaba2b09fac1d9fef/packages/opencode/src/cli/cmd/auth.ts#L121-L127) > > Lines 121 to 127 in [a272b58](/sst/opencode/commit/a272b58fe988addc5c0d18bbaba2b09fac1d9fef) > > if (provider === "amazon-bedrock") { > prompts.log.info( > "Amazon bedrock can be configured with standard AWS environment variables like AWS_PROFILE or AWS_ACCESS_KEY_ID", > ) > prompts.outro("Done") > return > } > Try running the model. > > ``` > opencode run hi --print-logs --model amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0 > ``` Thanks for this suggestion @superandrew213, it was useful to see at least that my aws sso is at least recognized by opencode and the model endpoint can be reached
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@guerillagorilla commented on GitHub (Jul 8, 2025):

@reedbender Dumb question, but are you sure you have completed the "request access to claude sonnet 4" in bedrock?

@guerillagorilla commented on GitHub (Jul 8, 2025): @reedbender Dumb question, but are you sure you have completed the "request access to claude sonnet 4" in bedrock?
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@reedbender commented on GitHub (Jul 8, 2025):

For context, here is my config.json ...

{
  "$schema": "https://opencode.ai/config.json",
  "theme": "catppuccin",
  "model": "amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0",
  "autoshare": false,
  "autoupdate": true
}
@reedbender commented on GitHub (Jul 8, 2025): For context, here is my `config.json` ... ``` { "$schema": "https://opencode.ai/config.json", "theme": "catppuccin", "model": "amazon-bedrock/anthropic.claude-sonnet-4-20250514-v1:0", "autoshare": false, "autoupdate": true } ```
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@reedbender commented on GitHub (Jul 8, 2025):

@reedbender Dumb question, but are you sure you have completed the "request access to claude sonnet 4" in bedrock?

@guerillagorilla ya, and I know that it is accessible because I could get a hi response from the cli with the same profile

@reedbender commented on GitHub (Jul 8, 2025): > [@reedbender](https://github.com/reedbender) Dumb question, but are you sure you have completed the "request access to claude sonnet 4" in bedrock? @guerillagorilla ya, and I know that it is accessible because I could get a hi response from the cli with the same profile
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@guerillagorilla commented on GitHub (Jul 8, 2025):

@reedbender Dumb question, but are you sure you have completed the "request access to claude sonnet 4" in bedrock?

@guerillagorilla ya, and I know that it is accessible because I could get a hi response from the cli with the same profile

good point and sorry I missed that. Just to check, I also re-ran the hi test against a model I dont have access to and did not get the hi text response as you did, but did get the expected AI_APICallError: undefined: You don't have access to the model with the specified model ID., so seems like something else

@guerillagorilla commented on GitHub (Jul 8, 2025): > > [@reedbender](https://github.com/reedbender) Dumb question, but are you sure you have completed the "request access to claude sonnet 4" in bedrock? > > [@guerillagorilla](https://github.com/guerillagorilla) ya, and I know that it is accessible because I could get a hi response from the cli with the same profile good point and sorry I missed that. Just to check, I also re-ran the hi test against a model I dont have access to and did not get the hi text response as you did, but did get the expected `AI_APICallError: undefined: You don't have access to the model with the specified model ID.`, so seems like something else
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@reedbender commented on GitHub (Jul 8, 2025):

ya somehow I think the TUI is not picking up the same auth context as is available in the cli

@reedbender commented on GitHub (Jul 8, 2025): ya somehow I think the TUI is not picking up the same auth context as is available in the cli
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@douglarek commented on GitHub (Jul 16, 2025):

This usage form with environment variable prefixes is too far-fetched. Please support global env file reading or allow configuration to directly set env

@douglarek commented on GitHub (Jul 16, 2025): This usage form with environment variable prefixes is too far-fetched. Please support global env file reading or allow configuration to directly set env
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@jond34 commented on GitHub (Jul 20, 2025):

Confirming @sandipwane's solution to alias allowed me to start querying my Bedrock-hosted model using opencode-bedrock. I even used my specific inference profile ARN in my config.

That said, I am not completely clear it's using 1) that exact ARN and 2) how many environment vars needed to be set. I already have Claude in a separate tab, so it may be using some env vars meant for that. I also had to explicitly set AWS_PROFILE=myprofile to enable the auth to work, despite aliasing.

@jond34 commented on GitHub (Jul 20, 2025): Confirming @sandipwane's solution to alias allowed me to start querying my Bedrock-hosted model using `opencode-bedrock`. I even used my specific inference profile ARN in my config. That said, I am not completely clear it's using 1) that exact ARN and 2) how many environment vars needed to be set. I already have Claude in a separate tab, so it may be using some env vars meant for that. I also had to explicitly set `AWS_PROFILE=myprofile` to enable the auth to work, despite aliasing.
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@jrgleason commented on GitHub (Aug 26, 2025):

Can someone help me out with the Windows equivalent?

@jrgleason commented on GitHub (Aug 26, 2025): Can someone help me out with the Windows equivalent?
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@jrgleason commented on GitHub (Aug 26, 2025):

This worked for me for powershell in Windows

 1. Check if your profile exists:
  Test-Path $PROFILE

  2. If it doesn't exist, create it:
  New-Item -Path $PROFILE -ItemType File -Force

  3. Edit your profile:
  notepad $PROFILE

  4. Add the function to the file:
  function opencode-bedrock {
      $env:AWS_PROFILE = "default"
      $env:AWS_REGION = "us-east-2"
      opencode.exe
  }

  5. Save and close the file, then reload your profile:
  . $PROFILE

For Command Prompt

Create a file called opencode-bedrock.bat in a directory that's in your PATH (like C:\Windows or create a dedicated
  folder):

  @echo off
  set AWS_PROFILE=default
  set AWS_REGION=us-east-2
  opencode.exe

  Then you can just type opencode-bedrock.bat from any command prompt.

Although note for the command one you need to use opencode-bedrock.bat instead of opencode-bedrock, but powershell works fine.

@jrgleason commented on GitHub (Aug 26, 2025): This worked for me for powershell in Windows ``` 1. Check if your profile exists: Test-Path $PROFILE 2. If it doesn't exist, create it: New-Item -Path $PROFILE -ItemType File -Force 3. Edit your profile: notepad $PROFILE 4. Add the function to the file: function opencode-bedrock { $env:AWS_PROFILE = "default" $env:AWS_REGION = "us-east-2" opencode.exe } 5. Save and close the file, then reload your profile: . $PROFILE ``` For Command Prompt ``` Create a file called opencode-bedrock.bat in a directory that's in your PATH (like C:\Windows or create a dedicated folder): @echo off set AWS_PROFILE=default set AWS_REGION=us-east-2 opencode.exe Then you can just type opencode-bedrock.bat from any command prompt. ``` Although note for the command one you need to use `opencode-bedrock.bat` instead of `opencode-bedrock`, but powershell works fine.
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@jrgleason commented on GitHub (Aug 26, 2025):

Wait nm now it starts but then won't respond :-(

@jrgleason commented on GitHub (Aug 26, 2025): Wait nm now it starts but then won't respond :-(
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@omarzina commented on GitHub (Sep 17, 2025):

I started having issues yesterday:
Up until now, I had a .env with AWS_PROFILE=bedrock-sso, it was picking it up fine, but now I have to do the export of the env var before opening opencode for it to pick up bedrock models.

edit: setting the env var AWS_PROFILE=bedrock-sso with mise did the trick, for some reason opencode stopped picking up my .env in the root of my project.

@omarzina commented on GitHub (Sep 17, 2025): I started having issues yesterday: Up until now, I had a `.env` with `AWS_PROFILE=bedrock-sso`, it was picking it up fine, but now I have to do the export of the env var before opening `opencode` for it to pick up bedrock models. edit: setting the env var `AWS_PROFILE=bedrock-sso` with `mise` did the trick, for some reason `opencode` stopped picking up my `.env` in the root of my project.
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Sep 17, 2025):

Yeah that was an intentional change bun reads .env vars in by default but this was causing unexpected behaviors most tools like this dont read .env by default

That bun behavior was disabled: https://github.com/sst/opencode/commit/ff1f4d6bf9fead4683c8ae32da9d6522119783ad

Prolly should have been advertised as breaking tho

@rekram1-node commented on GitHub (Sep 17, 2025): Yeah that was an intentional change bun reads .env vars in by default but this was causing unexpected behaviors most tools like this dont read .env by default That bun behavior was disabled: https://github.com/sst/opencode/commit/ff1f4d6bf9fead4683c8ae32da9d6522119783ad Prolly should have been advertised as breaking tho
yindo commented 2026-02-16 17:26:21 -05:00
Author
Owner
Copy Link
Copy Source

@thoroc commented on GitHub (Sep 19, 2025):

@rekram1-node so I need to have the env variable set instead of just using .env file? Not ideal but can work around it I guess.

@thoroc commented on GitHub (Sep 19, 2025): @rekram1-node so I need to have the env variable set instead of just using .env file? Not ideal but can work around it I guess.
yindo commented 2026-02-16 17:26:22 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Sep 19, 2025):

@thoroc yes that is correct

@rekram1-node commented on GitHub (Sep 19, 2025): @thoroc yes that is correct
yindo commented 2026-02-16 17:26:22 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Dec 27, 2025):

[automated] Closing due to 90+ days of inactivity. Feel free to reopen if you still need this!

@rekram1-node commented on GitHub (Dec 27, 2025): [automated] Closing due to 90+ days of inactivity. Feel free to reopen if you still need this!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#341
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?