Opencode Auth Kiro

OpenCode plugin for Kiro and AWS CodeWhisperer authentication. It registers Kiro models, provides Kiro login methods, and routes OpenAI-compatible requests through Kiro credentials.

Install

Add the plugin to your OpenCode config:

{
  "$schema": "https://opencode.ai/config.json",
  "plugin": ["opencode-auth-kiro"]
}

Restart OpenCode after changing plugin config. OpenCode loads plugins at startup.

After the plugin is loaded, select models as kiro/<model-id>, for example:

{
  "$schema": "https://opencode.ai/config.json",
  "plugin": ["opencode-auth-kiro"],
  "model": "kiro/claude-sonnet-4-5"
}

Authentication

Recommended flow when Kiro Desktop is already signed in:

1. Run opencode auth login.
2. Choose Kiro Desktop Session.
3. OpenCode imports ~/.aws/sso/cache/kiro-auth-token.json and the matching client registration from the Kiro Desktop cache.

Direct social login flow:

1. Run opencode auth login.
2. Choose Kiro Account Login.
3. Open the Kiro portal link and sign in with Google or GitHub.

Kiro CLI flow:

1. Run kiro-cli login if you already use the Kiro CLI.
2. Run opencode auth login.
3. Choose Kiro CLI Session to import the existing Kiro CLI session.

Kiro Account Login uses the same https://app.kiro.dev/signin portal flow as Kiro Desktop, but it can only exchange Google/GitHub social callbacks directly. For AWS Builder ID or IAM Identity Center accounts, use Kiro Desktop Session or Kiro CLI Session.

Models

Thinking mode is enabled automatically when you select a -thinking model. Thinking models expose reasoning: true, stream reasoning as reasoning_content, and include these variants:

| Variant | Thinking budget | | --- | --- | | low | 8192 | | medium | 16384 | | max | 32768 |

If no variant is selected, -thinking models use a default thinking budget of 20000.

The outgoing Kiro request uses native model fields:

{
  "additionalModelRequestFields": {
    "thinking": {
      "type": "enabled",
      "budget_tokens": 20000
    }
  }
}

You can override the budget per request with either top-level thinkingConfig or OpenCode/OpenAI-compatible provider options:

{
  "thinkingConfig": { "thinkingBudget": 32768 },
  "providerOptions": {
    "openaiCompatible": {
      "thinkingConfig": { "thinkingBudget": 32768 }
    }
  }
}

| Model ID | Notes | | --- | --- | | auto | Kiro auto routing | | claude-haiku-4-5 | Claude Haiku 4.5 | | claude-haiku-4-5-thinking | Thinking alias | | claude-sonnet-4 | Claude Sonnet 4.0 | | claude-sonnet-4-5 | Default model | | claude-sonnet-4-5-thinking | Thinking alias | | claude-sonnet-4-6 | 1M context | | claude-sonnet-4-6-thinking | 1M context, thinking alias | | claude-opus-4-5 | Claude Opus 4.5 | | claude-opus-4-5-thinking | Thinking alias | | claude-opus-4-6 | 1M context | | claude-opus-4-6-thinking | 1M context, thinking alias | | claude-opus-4-7 | 1M context | | claude-opus-4-7-thinking | 1M context, thinking alias | | claude-opus-4-8 | 1M context | | claude-opus-4-8-thinking | 1M context, thinking alias | | claude-3-7-sonnet | Claude 3.7 Sonnet | | minimax-m2.5 | MiniMax M2.5 | | minimax-m2.1 | MiniMax M2.1 | | glm-5 | GLM 5 | | deepseek-3.2 | DeepSeek 3.2 | | qwen3-coder-next | Qwen3 Coder Next |

Endpoints

The plugin follows the same public Kiro Desktop endpoint families found in the installed Kiro extension:

| Purpose | Endpoint | | --- | --- | | Portal sign-in | https://app.kiro.dev/signin | | Social token exchange | https://prod.{region}.auth.desktop.kiro.dev/oauth/token | | Desktop/social refresh | https://prod.{region}.auth.desktop.kiro.dev/refreshToken | | Chat streaming | https://q.{region}.amazonaws.com/generateAssistantResponse | | Usage limits | https://q.{region}.amazonaws.com/getUsageLimits | | Builder ID / IdC OIDC | https://oidc.{region}.amazonaws.com/* | | User info | https://view.awsapps.com/api/user/info |

Plugin Config

User config is loaded from ~/.config/opencode/kiro.json on macOS/Linux or %APPDATA%\opencode\kiro.json on Windows.

Project config is loaded from .opencode/kiro.json in the active OpenCode project directory. Project config overrides user config.

Supported options include:

{
  "$schema": "https://opencode.ai/config.json",
  "account_selection_strategy": "lowest-usage",
  "default_region": "us-east-1",
  "rate_limit_retry_delay_ms": 5000,
  "rate_limit_max_retries": 3,
  "request_timeout_ms": 120000,
  "token_expiry_buffer_ms": 60000,
  "usage_tracking_enabled": true,
  "auto_sync_kiro_cli": true,
  "auth_server_port_start": 19847,
  "auth_server_port_range": 10
}

Development

npm install
npm run typecheck
npm run build
npm test

npm test skips the live Kiro endpoint probe by default. Run it with KIRO_LIVE_PROBE=1 only when you intentionally want to hit the real endpoint.

The package published to npm contains dist, README.md, and package.json only. Source, tests, and build artifacts remain available in the GitHub repository.

Links

| Resource | URL | | --- | --- | | npm package | https://www.npmjs.com/package/opencode-auth-kiro | | GitHub repository | https://github.com/YeiHai/Opencode-Auth-Kiro | | OpenCode config schema | https://opencode.ai/config.json |