anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[FEATURE]: Store provider credentials in environment variables #3490

New Issue
Open
opened 2026-02-16 17:40:19 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 17:40:19 -05:00
Owner
Copy Link
Copy Source

Originally created by @nagyv on GitHub (Dec 12, 2025).

Feature hasn't been suggested before.

  • I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

User problem

As a security minded user, I don't want to store api keys in files, especially not in a shared environment.

Instead of storing provider credentials in ~/.local/share/opencode/auth.json, I'd prefer to either have the location configurable (e.g. setting $OPENCODE_AUTH_JSON would tell opencode where it should read/write the auth.json file) or allow passing provider keys through environment variables.

Proposal

I see two different approaches

Configurable auth.json location (recommended)

Currently, the location of the opencode auth.json is hardcoded. We should make this configurable with the OPENCODE_AUTH_JSON environment variable. The default value can be ~/.local/share/opencode/auth.json to keep it backward compatible.

Passing provider keys from environment variables

I see three possible approaches:

  1. for every configured provider with an invalid/not configured apiKey, opencode looks for the OPENCODE_<PROVIDERNAME>_APIKEY environment variable
  2. for every known provider, opencode looks for the OPENCODE_<PROVIDERNAME>_APIKEY environment variable
  3. for every configured provider with type: "api", keyFrom: "envVar" opencode looks for the OPENCODE_<PROVIDERNAME>_APIKEY environment variable

Related issues

Originally created by @nagyv on GitHub (Dec 12, 2025). ### Feature hasn't been suggested before. - [x] I have verified this feature I'm about to request hasn't been suggested before. ### Describe the enhancement you want to request ## User problem As a security minded user, I don't want to store api keys in files, especially not in a shared environment. Instead of storing provider credentials in `~/.local/share/opencode/auth.json`, I'd prefer to either have the location configurable (e.g. setting `$OPENCODE_AUTH_JSON` would tell opencode where it should read/write the auth.json file) or allow passing provider keys through environment variables. ## Proposal I see two different approaches ### Configurable auth.json location (recommended) Currently, the location of the opencode auth.json is hardcoded. We should make this configurable with the `OPENCODE_AUTH_JSON` environment variable. The default value can be `~/.local/share/opencode/auth.json` to keep it backward compatible. ### Passing provider keys from environment variables I see three possible approaches: 1. for every configured provider with an invalid/not configured apiKey, opencode looks for the `OPENCODE_<PROVIDERNAME>_APIKEY` environment variable 2. for every known provider, opencode looks for the `OPENCODE_<PROVIDERNAME>_APIKEY` environment variable 3. for every configured provider with `type: "api", keyFrom: "envVar"` opencode looks for the `OPENCODE_<PROVIDERNAME>_APIKEY` environment variable ## Related issues - https://github.com/sst/opencode/issues/318 is the closes related, but it misses the configurable auth.json proposal that could work well in many situations
yindo added the discussion label 2026-02-16 17:40:19 -05:00
yindo commented 2026-02-16 17:40:20 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Dec 12, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #4961: Feature Request: Zero-Trust Architecture for Environment Variable Security - Discusses protecting credentials when transmitted to LLM providers, with broader security scope
  • #318: feature: Ability to pass credentials without storing in environment file - Requests environment variable and command substitution support for provider credentials
  • #4318: [FEATURE]: Allow storage of secrets in system credential store - Proposes storing API keys in system keyring/credential stores instead of plaintext files

Feel free to ignore if your specific use case differs from these alternatives.

@github-actions[bot] commented on GitHub (Dec 12, 2025): This issue might be a duplicate of existing issues. Please check: - #4961: Feature Request: Zero-Trust Architecture for Environment Variable Security - Discusses protecting credentials when transmitted to LLM providers, with broader security scope - #318: feature: Ability to pass credentials without storing in environment file - Requests environment variable and command substitution support for provider credentials - #4318: [FEATURE]: Allow storage of secrets in system credential store - Proposes storing API keys in system keyring/credential stores instead of plaintext files Feel free to ignore if your specific use case differs from these alternatives.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label discussion
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#3490
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?