opencode-proxycli-auth

An opencode plugin that adds a CliProxy login to the native anthropic provider, routing it through a self-hosted CLIProxyAPI ("proxycli") endpoint. The proxy owns your Claude accounts and does the Claude Code cloaking server-side, so every device just points at the same proxy: no per-device OAuth, add or remove accounts in one place (on the proxy server).

This is a pure proxy plugin. Its only job is the CliProxy login, and it has no dependency on any OAuth plugin. The client sends only an api-key to the proxy (x-api-key header); all Anthropic OAuth is handled server-side by the proxy from its pooled accounts.

It is also self-contained: the plugin injects its own Anthropic model catalog (display names, context/output limits, thinking options, zeroed cost) into the merged config through opencode's config hook, and auto-enables the Anthropic 1M-context beta per request for the models that support it. The ONLY thing you add to opencode.json is this plugin, nothing model- or proxy-related has to live in opencode's own config.

opencode auth login  ->  Anthropic
  CliProxy                  <- added by this plugin

Install

// ~/.config/opencode/opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "plugin": ["opencode-proxycli-auth"]
}

Then restart opencode.

Connect

opencode auth login

1. Pick Anthropic. Since CliProxy is the only method this plugin exposes, opencode goes straight to it.
2. Enter your CLIProxyAPI URL (e.g. http://127.0.0.1:8317).
3. Enter your CLIProxyAPI api-key at opencode's masked "Enter your API key" prompt.

The URL is stored in the credential metadata and the api-key becomes the credential key; anthropic/* then runs through the proxy. Cost is zeroed (subscription-backed). There is no login-time reachability check: a wrong URL or key surfaces on the first request, not during login.

About the URL

Enter the proxy origin only (scheme + host + port). The plugin appends the Anthropic path (/v1/messages) itself, so you do not include it. A bare host:port works too (http is assumed), and a trailing /v1 or /v1/messages is stripped for you. If your proxy sits behind a path prefix (e.g. /claude), include just that prefix.

Models

The plugin registers the Anthropic model catalog itself (via the config hook), so you do not define models in opencode.json. Edit the PROXY_MODELS map in src/index.ts to change display names, context/output limits, or thinking options. User-defined entries in opencode.json (if any) win over the plugin's defaults. Shipped defaults:

| Model | Context | Output | Thinking | 1M beta | | --------------------------- | --------- | ------ | -------- | ------- | | claude-opus-4-8 | 1,048,576 | 64,000 | adaptive | auto | | claude-sonnet-5 | 1,048,576 | 64,000 | adaptive | auto | | claude-haiku-4-5-20251001 | 200,000 | 64,000 | - | - |

For any model given a 1M context window, the plugin auto-adds the anthropic-beta: context-1m-2025-08-07 header to its proxied requests, which is what actually unlocks the 1M window on Anthropic's side (opencode's context limit alone only controls when a session auto-compacts). Models without the entitlement, such as Haiku (the proxy rejects the 1M beta for it), stay at the standard 200K window and never receive the header.

Notes

• One Claude account = one owner. Add each Claude account to the proxy only, and do not also log that same account into a client-side OAuth plugin elsewhere: the proxy must be the single owner (Claude rotates the refresh token, which would otherwise invalidate it).
• Need a direct client-side OAuth path instead (your own Claude Pro/Max, no proxy)? Use a dedicated OAuth plugin such as @ex-machina/opencode-anthropic-auth on that device. This plugin stays proxy-only on purpose.

Build

bun install
bun run build   # -> dist/index.js (+ dist/index.d.ts)

No runtime dependencies: the plugin bundles to a single file and only needs opencode's own @opencode-ai/plugin types at build time.

License

MIT