OpenCode Anthropic Auth Plugin

An OpenCode plugin that provides Anthropic OAuth authentication, enabling Claude Pro/Max users to use their subscription directly with OpenCode.

Usage

Add the plugin to your OpenCode configuration:

{
  "plugin": ["@ex-machina/opencode-anthropic-auth"]
}

[!TIP] It is STRONGLY advised that you pin the plugin to a version. This will keep you from getting automatic updates; however, this will protect you from nefarious updates.

This holds true for ANY OpenCode plugin. If you do not pin them, OpenCode will automatically update them on startup. It's a massive vulnerability waiting to happen.

Example of pinned version

{
  "plugin": ["@ex-machina/[email protected]"]
}

Authentication Methods

The plugin provides three authentication options:

• Claude Pro/Max - OAuth flow via claude.ai for Pro/Max subscribers. Uses your existing subscription at no additional API cost.
• Create an API Key - OAuth flow via console.anthropic.com that creates an API key on your behalf.
• Manually enter API Key - Standard API key entry for users who already have one.

How It Works

For Claude Pro/Max authentication, the plugin:

1. Initiates a PKCE OAuth flow against Anthropic's authorization endpoint
2. Exchanges the authorization code for access and refresh tokens
3. Automatically refreshes expired tokens
4. Injects the required OAuth headers and beta flags into API requests
5. Sanitizes the system prompt for compatibility (see below)
6. Zeros out model costs (since usage is covered by the subscription)

System Prompt Sanitization

The Anthropic API for Max subscriptions requires the system prompt to identify as Claude Code. The plugin rewrites the system prompt on each request using an anchor-based approach that minimizes what gets changed:

1. Identity swap — The OpenCode identity line is removed and replaced with the Claude Code identity.
2. Paragraph removal by anchor — Any paragraph containing a known URL anchor (e.g. github.com/anomalyco/opencode, opencode.ai/docs) is removed entirely. This is resilient to upstream rewording — as long as the anchor URL appears somewhere in the paragraph, the removal works regardless of surrounding text changes.
3. Inline text replacements — Short branded strings inside paragraphs we want to keep are replaced (e.g. "OpenCode" → "the assistant" in the professional objectivity section).

Everything else in the system prompt is preserved: tone/style guidance, task management instructions, tool usage policy, environment info, skills, user/project instructions, and file paths containing "opencode".

Development

Local Testing

Use bun run dev to test plugin changes locally without publishing to npm:

bun run dev

This does three things:

1. Builds the plugin
2. Symlinks the build output into .opencode/plugins/ so OpenCode loads it as a local plugin
3. Starts tsc --watch for automatic rebuilds on source changes

After starting the dev script, restart OpenCode in this project directory to pick up the local build. Any edits to src/ will trigger a rebuild — restart OpenCode again to load the new version.

Ctrl+C stops the watcher and cleans up the symlink. If the process was killed without cleanup (e.g. kill -9), you can manually remove the symlink:

bun run dev:clean

[!NOTE] If you have the npm version of this plugin in your global OpenCode config, both will load. The local version takes precedence for auth handling.

Publishing

This project uses changesets for versioning and publishing. See the changeset README for more details.

bun change          # create a changeset describing your changes

When changesets are merged to main, CI will automatically open a release PR. Merging that PR publishes to npm.

License

MIT