OpenCode Anthropic Auth Plugin

[!WARNING] This plugin comes with no guarantees. You might be banned for breaking the TOS, you might not be. I don't work at Anthropic, nor am I an attorney.

Use your best judgment and don't try to abuse the subscriptions. Plugins like oh-my-openagent are known to trigger bans. Please be careful when using Ralph loops or insanely heavy usage patterns.

[!IMPORTANT] If you are seeing issues, please try to rm -rf ~/.cache/opencode and check your opencode.json config to make sure you're on the latest version.

Try this FIRST before making an Issue. Thanks!

An OpenCode plugin that provides Anthropic OAuth authentication, enabling Claude Pro/Max users to use their subscription directly with OpenCode.

Usage

Add the plugin to your OpenCode configuration:

{
  "plugin": ["@ex-machina/opencode-anthropic-auth"]
}

[!TIP] It is STRONGLY advised that you pin the plugin to a version. This will keep you from getting automatic updates; however, this will protect you from nefarious updates.

This holds true for ANY OpenCode plugin. If you do not pin them, OpenCode will automatically update them on startup. It's a massive vulnerability waiting to happen.

Example of pinned version

{
  "plugin": ["@ex-machina/[email protected]"]
}

Authentication Methods

The plugin provides three authentication options:

• Claude Pro/Max - OAuth flow via claude.ai for Pro/Max subscribers. Uses your existing subscription at no additional API cost.
• Create an API Key - OAuth flow via console.anthropic.com that creates an API key on your behalf.
• Manually enter API Key - Standard API key entry for users who already have one.

Configuration

The plugin supports the following environment variables:

| Variable | Description | |-----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ANTHROPIC_BASE_URL | Override the API endpoint URL (e.g. for proxying). Must be a valid HTTP(S) URL. | | ANTHROPIC_INSECURE | Set to 1 or true to skip TLS certificate verification. Only effective when ANTHROPIC_BASE_URL is also set. |

How It Works

For Claude Pro/Max authentication, the plugin:

1. Initiates a PKCE OAuth flow against Anthropic's authorization endpoint
2. Exchanges the authorization code for access and refresh tokens
3. Automatically refreshes expired tokens
4. Injects the required OAuth headers and beta flags into API requests
5. Sanitizes the system prompt for compatibility (see below)
6. Zeros out model costs (since usage is covered by the subscription)

System Prompt Sanitization

The Anthropic API for Max subscriptions has specific requirements for the system prompt to identify as Claude Code. The plugin rewrites the system prompt on each request using an anchor-based approach that minimizes what gets changed:

1. Identity swap — The OpenCode identity line is removed and replaced with the Claude Code identity.
2. Paragraph removal by anchor — Any paragraph containing a known URL anchor (e.g. github.com/anomalyco/opencode, opencode.ai/docs) is removed entirely. This is resilient to upstream rewording — as long as the anchor URL appears somewhere in the paragraph, the removal works regardless of surrounding text changes.
3. Inline text replacements — Short branded strings inside paragraphs we want to keep are replaced (e.g. "OpenCode" → "the assistant" in the professional objectivity section).

Everything else in the system prompt is preserved: tone/style guidance, task management instructions, tool usage policy, environment info, skills, user/project instructions, and file paths containing "opencode". The sanitized system prompt is structured as three blocks in system[]: the billing header, the Claude Code identity line, and the remaining system content.

Development

Local Testing

Use bun run dev to test plugin changes locally without publishing to npm:

bun run dev

This does three things:

1. Builds the plugin
2. Symlinks the build output into .opencode/plugins/ so OpenCode loads it as a local plugin
3. Starts tsc --watch for automatic rebuilds on source changes

After starting the dev script, restart OpenCode in this project directory to pick up the local build. Any edits to src/ will trigger a rebuild — restart OpenCode again to load the new version.

Ctrl+C stops the watcher and cleans up the symlink. If the process was killed without cleanup (e.g. kill -9), you can manually remove the symlink:

bun run dev:clean

[!NOTE] If you have the npm version of this plugin in your global OpenCode config, both will load. The local version takes precedence for auth handling.

Publishing

This project uses changesets for versioning and publishing. See the changeset README for more details.

bun change          # create a changeset describing your changes

When changesets are merged to main, CI will automatically open a release PR. Merging that PR publishes to npm.

License

MIT