anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-23 10:45:33 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Request to support Dynamic API keys through an apiKeyHelper #912

New Issue
Open
opened 2026-02-16 17:28:45 -05:00 by yindo · 7 comments
yindo commented 2026-02-16 17:28:45 -05:00
Owner
Copy Link
Copy Source

Originally created by @mvalkon on GitHub (Jul 25, 2025).

Originally assigned to: @thdxr on GitHub.

Feature Request: Support Dynamic API Keys with apiKeyHelper

Add support for rotating JWT tokens or API keys by allowing users to configure a helper script in their configuration which opencode can then call to refresh a token based on a configurable refresh interval time.

Problem

Currently, opencode only supports static API keys. This creates friction for users who integrate to models via, for example, a liteLLM proxy using rotating tokens or api keys with short expiration times.

Requested Feature

Support an apiKeyHelper configuration option that executes a user-defined script to generate API keys dynamically, and accepts a token refresh interval as configuration via the config files and/or env vars.

Reference

Claude Code implements this feature as explained here https://docs.anthropic.com/en/docs/claude-code/llm-gateway#litellm-configuration

Originally created by @mvalkon on GitHub (Jul 25, 2025). Originally assigned to: @thdxr on GitHub. ## Feature Request: Support Dynamic API Keys with apiKeyHelper Add support for rotating JWT tokens or API keys by allowing users to configure a helper script in their configuration which opencode can then call to refresh a token based on a configurable refresh interval time. ### Problem Currently, opencode only supports static API keys. This creates friction for users who integrate to models via, for example, a liteLLM proxy using rotating tokens or api keys with short expiration times. ### Requested Feature Support an `apiKeyHelper` configuration option that executes a user-defined script to generate API keys dynamically, and accepts a token refresh interval as configuration via the config files and/or env vars. ### Reference Claude Code implements this feature as explained here https://docs.anthropic.com/en/docs/claude-code/llm-gateway#litellm-configuration
yindo commented 2026-02-16 17:28:45 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Dec 27, 2025):

[automated] Closing due to 90+ days of inactivity. Feel free to reopen if you still need this!

@rekram1-node commented on GitHub (Dec 27, 2025): [automated] Closing due to 90+ days of inactivity. Feel free to reopen if you still need this!
yindo commented 2026-02-16 17:28:45 -05:00
Author
Owner
Copy Link
Copy Source

@yordis commented on GitHub (Dec 28, 2025):

@rekram1-node I would appreciate if you reopen the issue, I would still avoid writing secrets to my FS and ideally, they only exists on Memory.

@yordis commented on GitHub (Dec 28, 2025): @rekram1-node I would appreciate if you reopen the issue, I would still avoid writing secrets to my FS and ideally, they only exists on Memory.
yindo commented 2026-02-16 17:28:45 -05:00
Author
Owner
Copy Link
Copy Source

@gabry-lab commented on GitHub (Jan 6, 2026):

any updates here?

@gabry-lab commented on GitHub (Jan 6, 2026): any updates here?
yindo commented 2026-02-16 17:28:45 -05:00
Author
Owner
Copy Link
Copy Source

@xavhoff commented on GitHub (Jan 8, 2026):

I will also be interested in that feature. Our org setup in based on rotating JWT tokens and we need something like the apiKeyHelper setting from Claude Code to be able to continue our sessions without being stopped by invalid/expired tokens.

Doc from Anthropic: https://code.claude.com/docs/en/settings#available-settings

@xavhoff commented on GitHub (Jan 8, 2026): I will also be interested in that feature. Our org setup in based on rotating JWT tokens and we need something like the `apiKeyHelper` setting from Claude Code to be able to continue our sessions without being stopped by invalid/expired tokens. Doc from Anthropic: https://code.claude.com/docs/en/settings#available-settings
yindo commented 2026-02-16 17:28:45 -05:00
Author
Owner
Copy Link
Copy Source

@yordis commented on GitHub (Jan 8, 2026):

I gave it a tried at #2023 looking back, I rather do not cache anything and keep it only in memory, otherwise, what is the point (tools like Go now have built-in memory protections tbw. But I didn't get any feedback on it.

This is a common situation, the "abstraction" would be around the secret management itself, there could be a shared interface such as reveal or whatever that gets the token.

I can give it a second try, just would prefer to have some level of support from core maintainers, primarily because I do not want to be pinging people about things and feel I am in the wrong doing type of thing.

@yordis commented on GitHub (Jan 8, 2026): I gave it a tried at #2023 looking back, I rather do not cache anything and keep it only in memory, otherwise, what is the point (tools like Go now have built-in memory protections tbw. But I didn't get any feedback on it. This is a common situation, the "abstraction" would be around the secret management itself, there could be a shared interface such as `reveal` or whatever that gets the token. I can give it a second try, just would prefer to have some level of support from core maintainers, primarily because I do not want to be pinging people about things and feel I am in the wrong doing type of thing.
yindo commented 2026-02-16 17:28:45 -05:00
Author
Owner
Copy Link
Copy Source

@drummerwolli commented on GitHub (Jan 14, 2026):

i had opencode write me a small script to update the apiKey in the opencode.json file:

#!/bin/bash

# Refresh OpenCode apiKey automatically
# This script updates the apiKey in ~/.config/opencode/opencode.json every hour

CONFIG_FILE="${HOME}/.config/opencode/opencode.json"
REFRESH_INTERVAL=3600  # 1 hour in seconds

echo "[$(date '+%Y-%m-%d %H:%M:%S')] Refreshing OpenCode apiKey ..."

# Get new apiKey from a CLI command
NEW_API_KEY=$(<PUT_YOUR_CLI_COMMAND_IN_HERE> 2>/dev/null)

if [ -z "$NEW_API_KEY" ]; then
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] ERROR: Failed to get new apiKey for opencode.json!"
    return 1
fi

# Check if config file exists
if [ ! -f "$CONFIG_FILE" ]; then
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] ERROR: Config file not found at $CONFIG_FILE"
    return 1
fi

# Update the apiKey in the JSON file
# Using sed to replace the apiKey value while preserving formatting
sed -i.bak "s/\"apiKey\": \"[^\"]*\"/\"apiKey\": \"$NEW_API_KEY\"/" "$CONFIG_FILE"

if [ $? -eq 0 ]; then
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] apiKey refreshed successfully"
    # Clean up backup file
    rm -f "${CONFIG_FILE}.bak"
    return 0
else
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] ERROR: Failed to update config file"
    # Restore backup
    mv "${CONFIG_FILE}.bak" "$CONFIG_FILE"
    return 1
fi

I then put this script into my .zshrc file. works sufficiently for me until a "proper" solution comes around.

@drummerwolli commented on GitHub (Jan 14, 2026): i had opencode write me a small script to update the apiKey in the opencode.json file: ```bash #!/bin/bash # Refresh OpenCode apiKey automatically # This script updates the apiKey in ~/.config/opencode/opencode.json every hour CONFIG_FILE="${HOME}/.config/opencode/opencode.json" REFRESH_INTERVAL=3600 # 1 hour in seconds echo "[$(date '+%Y-%m-%d %H:%M:%S')] Refreshing OpenCode apiKey ..." # Get new apiKey from a CLI command NEW_API_KEY=$(<PUT_YOUR_CLI_COMMAND_IN_HERE> 2>/dev/null) if [ -z "$NEW_API_KEY" ]; then echo "[$(date '+%Y-%m-%d %H:%M:%S')] ERROR: Failed to get new apiKey for opencode.json!" return 1 fi # Check if config file exists if [ ! -f "$CONFIG_FILE" ]; then echo "[$(date '+%Y-%m-%d %H:%M:%S')] ERROR: Config file not found at $CONFIG_FILE" return 1 fi # Update the apiKey in the JSON file # Using sed to replace the apiKey value while preserving formatting sed -i.bak "s/\"apiKey\": \"[^\"]*\"/\"apiKey\": \"$NEW_API_KEY\"/" "$CONFIG_FILE" if [ $? -eq 0 ]; then echo "[$(date '+%Y-%m-%d %H:%M:%S')] apiKey refreshed successfully" # Clean up backup file rm -f "${CONFIG_FILE}.bak" return 0 else echo "[$(date '+%Y-%m-%d %H:%M:%S')] ERROR: Failed to update config file" # Restore backup mv "${CONFIG_FILE}.bak" "$CONFIG_FILE" return 1 fi ``` I then put this script into my `.zshrc` file. works sufficiently for me until a "proper" solution comes around.
yindo commented 2026-02-16 17:28:45 -05:00
Author
Owner
Copy Link
Copy Source

@jeblackburn-mdb commented on GitHub (Jan 21, 2026):

A merge here would be awesome.

The problem I'm facing is that I'm working for a corporate client that requires all of its LLM calls to go through their internal, OpenAI-compliant gateway. The client issues tokens from an OAuth provider that expire after about an hour. I frequently execute workflows that last longer than 30 minutes (the average time interval between when I start a workflow and when the token expires). Then I'm stuck fielding 403 responses from the LLM. It's a real pain.

@jeblackburn-mdb commented on GitHub (Jan 21, 2026): A merge here would be awesome. The problem I'm facing is that I'm working for a corporate client that requires all of its LLM calls to go through their internal, OpenAI-compliant gateway. The client issues tokens from an OAuth provider that expire after about an hour. I frequently execute workflows that last longer than 30 minutes (the average time interval between when I start a workflow and when the token expires). Then I'm stuck fielding 403 responses from the LLM. It's a real pain.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#912
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?