opencode-claude-auth

Self-contained Anthropic auth provider for OpenCode using your Claude Code credentials — no separate login or API key needed.

How it works

The plugin registers its own auth provider with a custom fetch handler that intercepts all Anthropic API requests. It reads OAuth tokens from the macOS Keychain (or ~/.claude/.credentials.json — or $CLAUDE_CONFIG_DIR/.credentials.json if that env var is set — on other platforms), caches them in memory with a 30-second TTL, and handles the full request lifecycle — no builtin Anthropic auth plugin required. On macOS, multiple Claude Code accounts are detected automatically and can be switched via opencode auth login.

It also syncs credentials to OpenCode's auth.json as a fallback (on Windows, it writes to both %USERPROFILE%\.local\share\opencode\auth.json and %LOCALAPPDATA%\opencode\auth.json to cover all installation methods). If a token is near expiry, it refreshes directly via Anthropic's OAuth endpoint (zero LLM tokens consumed), falling back to the Claude CLI if the direct refresh fails. Background re-sync runs every 5 minutes.

Prerequisites

• Claude Code installed and authenticated (run claude at least once)
• OpenCode installed

macOS is preferred (uses Keychain). Linux and Windows work via the credentials file fallback.

Installation

For Humans

Option A: Let an LLM do it

Paste this into any LLM agent (Claude Code, OpenCode, Cursor, etc.):

Install the opencode-claude-auth plugin and configure it by following: https://raw.githubusercontent.com/griffinmartin/opencode-claude-auth/main/installation.md

Option B: Manual setup

1. Add the plugin to ~/.config/opencode/opencode.json:

   {
     "plugin": ["opencode-claude-auth@latest"]
   }
   

   The @latest tag ensures OpenCode always pulls the newest version on startup. No manual npm install is needed — OpenCode automatically installs npm plugins using Bun at startup.

2. Use it — just run OpenCode. The plugin handles auth automatically using your Claude Code credentials.

For LLM Agents

See installation.md for step-by-step agent instructions.

Usage

Just run OpenCode. The plugin handles auth automatically — it reads your Claude Code credentials, provides them to the Anthropic API, and refreshes them in the background. If your credentials aren't OAuth-based, the plugin falls through to standard API key auth.

Supported models

13 supported models. Run pnpm run test:models to verify against your account.

Credential sources

The plugin checks these in order:

1. macOS Keychain (all Claude Code-credentials* entries — multiple accounts are detected automatically)
2. ~/.claude/.credentials.json (fallback, works on all platforms; if CLAUDE_CONFIG_DIR is set, reads $CLAUDE_CONFIG_DIR/.credentials.json instead)

Multiple accounts (macOS)

If you have multiple Claude Code accounts authenticated on macOS, the plugin detects all of them from the Keychain automatically. Each account is labeled by its subscription tier (Claude Pro, Claude Max, etc.).

To switch accounts:

opencode auth login

Select "Switch Claude Code account" and pick the account you want to use. Your selection is persisted across sessions.

If only one account is found, the switcher is hidden and the plugin uses it directly.

Troubleshooting

Diagnostic logging

If you're hitting auth errors that are hard to reproduce, enable debug logging to capture the full auth flow:

export CLAUDE_AUTH_DEBUG=1

Restart OpenCode and reproduce the issue. The plugin writes structured JSON logs to ~/.local/share/opencode/claude-auth-debug.log. All secrets (tokens, API keys) are automatically redacted — the log file is safe to paste into a GitHub issue.

To write logs to a custom path:

export CLAUDE_AUTH_DEBUG=/tmp/claude-auth-debug.log

Disable when done:

unset CLAUDE_AUTH_DEBUG

Long context (1M)

1M token context is supported natively — the API no longer requires a beta flag for it, so the plugin doesn't send the legacy context-1m-2025-08-07 header.

If your plan doesn't cover long context billing, requests beyond the standard window fail with "Extra usage is required for long context requests". When a long context error is caused by a beta flag (e.g. one added via ANTHROPIC_BETA_FLAGS), the plugin retries without the offending flag.

Validating OAuth refresh

To verify the direct OAuth token refresh works with your credentials:

pnpm run validate:oauth           # refresh + write-back (safe, keeps credentials valid)
pnpm run validate:oauth -- --dry-run  # show what would be sent without making the request

This reads your stored credentials, calls Anthropic's OAuth token endpoint, and writes the new tokens back to storage. Refresh tokens rotate on each use, so write-back is enabled by default to keep your stored credentials valid.

Environment variable overrides

All configurable parameters can be overridden via environment variables. If Anthropic changes something before we publish an update, set an env var and keep working: