remote: Duplicate header: "Authorization" when both tokens are in use #6853

Closed
opened 2026-02-16 18:05:26 -05:00 by yindo · 2 comments
Owner

Originally created by @cogni-ai-ee on GitHub (Jan 19, 2026).

Originally assigned to: @thdxr on GitHub.

Description

When running anomalyco/opencode/github@latest, it errors:

Adding reaction...
opencode session ses_4285aff4fffewIYz6Nd2Nd0g33
Fetching prompt data for PR...
Checking out local branch...
remote: Duplicate header: "Authorization"
fatal: unable to access 'https://github.com/Cogni-AI-OU/.github/': The requested URL returned error: 400

I'm using both GITHUB_TOKEN and OPENCODE_API_KEY and I think it's related.
However when I've removed GITHUB_TOKEN, then action doesn't have access to gh api command:

|  Bash     {"command":"gh api repos/:owner/:repo/actions/runs --jq '.workflow_runs[:3] | .[] | \"\\(.id) \\(.name) \\(.conclusion) \\(.head_sha[0:7])\"'","description":"Get recent workflow runs via API"}

I don't have access to the GitHub API.

I'm happy to use one API, but then gh doesn't work for some reason.

Plugins

n/a

OpenCode version

latest

Steps to reproduce

Potentially it's related to both tokens being present:

      - uses: anomalyco/opencode/github@latest
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}

Screenshot and/or share link

No response

Operating System

Ubuntu

Terminal

GitHub Actions

Originally created by @cogni-ai-ee on GitHub (Jan 19, 2026). Originally assigned to: @thdxr on GitHub. ### Description When running `anomalyco/opencode/github@latest`, it errors: ``` Adding reaction... opencode session ses_4285aff4fffewIYz6Nd2Nd0g33 Fetching prompt data for PR... Checking out local branch... remote: Duplicate header: "Authorization" fatal: unable to access 'https://github.com/Cogni-AI-OU/.github/': The requested URL returned error: 400 ``` I'm using both `GITHUB_TOKEN` and `OPENCODE_API_KEY` and I think it's related. However when I've removed `GITHUB_TOKEN`, then action doesn't have access to `gh api` command: ``` | Bash {"command":"gh api repos/:owner/:repo/actions/runs --jq '.workflow_runs[:3] | .[] | \"\\(.id) \\(.name) \\(.conclusion) \\(.head_sha[0:7])\"'","description":"Get recent workflow runs via API"} I don't have access to the GitHub API. ``` I'm happy to use one API, but then `gh` doesn't work for some reason. ### Plugins n/a ### OpenCode version latest ### Steps to reproduce Potentially it's related to both tokens being present: ``` - uses: anomalyco/opencode/github@latest env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }} ``` ### Screenshot and/or share link _No response_ ### Operating System Ubuntu ### Terminal GitHub Actions
yindo added the bug label 2026-02-16 18:05:26 -05:00
yindo closed this issue 2026-02-16 18:05:26 -05:00
Author
Owner

@github-actions[bot] commented on GitHub (Jan 19, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #7325: Github plugin having duplicate Authorization header (problem with private repos?) - Describes the exact same "remote: Duplicate header: Authorization" error when using OpenCode with GitHub Actions

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 19, 2026): This issue might be a duplicate of existing issues. Please check: - #7325: Github plugin having duplicate Authorization header (problem with private repos?) - Describes the exact same "remote: Duplicate header: Authorization" error when using OpenCode with GitHub Actions Feel free to ignore if none of these address your specific case.
Author
Owner

@cogni-ai-ee commented on GitHub (Jan 19, 2026):

The existing issue is correct, I was missing persist-credentials: false for the actions/checkout@v6.

@cogni-ai-ee commented on GitHub (Jan 19, 2026): > * [Github plugin having duplicate Authorization header (problem with private repos?) #7325](https://github.com/anomalyco/opencode/issues/7325): The existing issue is correct, I was missing `persist-credentials: false` for the `actions/checkout@v6`.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#6853