Skip to content

Custom @ai-sdk/anthropic provider loads correctly but drops API key at runtime when using custom baseURL #21737

New issue
New issue
Closed as not planned
Closed as not planned
Custom @ai-sdk/anthropic provider loads correctly but drops API key at runtime when using custom baseURL#21737
Assignees
nexxeln

Description

@tpwcnls
tpwcnls
opened on Apr 9, 2026

Bug: Custom @ai-sdk/anthropic provider loads correctly but drops API key at runtime when using custom baseURL

Summary

On OpenCode 1.4.2 on Windows, a custom Anthropic native provider can be discovered correctly from opencode.json, and its model can be selected successfully.

However, when the model is actually executed, the runtime request fails with:

401 invalid_request_error: You didn't provide an API key. You need to provide your API key in an Authorization header using Bearer auth

In the same environment, with the same API key, the same project, and the same Claude model, switching only the provider implementation to @ai-sdk/openai-compatible succeeds immediately and returns OK.

This strongly suggests a runtime auth propagation issue in OpenCode's handling of custom native Anthropic providers, rather than a config parsing issue.

Environment

  • OpenCode: 1.4.2
  • OS: Windows
  • Entry point: opencode-cli.exe run --print-logs
  • Proxy service: ofox.ai

Minimal Reproduction Config

File:

  • F:\Project\AIBuilder\OpenCodeTest\opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "ofox-anthropic-native": {
      "npm": "@ai-sdk/anthropic",
      "name": "Ofox Anthropic Native",
      "options": {
        "baseURL": "https://api.ofox.ai/anthropic",
        "apiKey": "{file:C:/Users/Roger/.config/opencode/.secrets/ofox-api-key}"
      },
      "models": {
        "claude-haiku-4.5": {
          "name": "Claude Haiku 4.5"
        }
      }
    },
    "ofox-openai-check": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "Ofox OpenAI Check",
      "options": {
        "baseURL": "https://api.ofox.ai/v1",
        "apiKey": "{file:C:/Users/Roger/.config/opencode/.secrets/ofox-api-key}"
      },
      "models": {
        "anthropic/claude-haiku-4.5": {
          "name": "Claude Haiku 4.5"
        }
      }
    }
  }
}

Reproduction Steps

Set the environment:

$env:HOME='F:\Project\AIBuilder\OpenCodeTest\.tmphome'
$env:USERPROFILE='F:\Project\AIBuilder\OpenCodeTest\.tmphome'

Run the native Anthropic provider:

& 'C:\Users\Roger\AppData\Local\opencode\opencode-cli.exe' run --model ofox-anthropic-native/claude-haiku-4.5 --print-logs 'Reply with OK only.'

Expected Behavior

The configured options.apiKey should be propagated into the final request, and the request should authenticate successfully against the custom Anthropic-compatible endpoint.

Actual Behavior

The provider and model are discovered successfully, but the runtime request fails with:

You didn't provide an API key. You need to provide your API key in an Authorization header using Bearer auth

Evidence

The following log lines show that:

  1. the custom provider is discovered,
  2. OpenCode actually uses the bundled @ai-sdk/anthropic provider path,
  3. the final request returns 401 with a missing API key error.
INFO  service=provider providerID=ofox-anthropic-native found
INFO  service=llm providerID=ofox-anthropic-native modelID=claude-haiku-4.5 ...
INFO  service=provider providerID=ofox-anthropic-native pkg=@ai-sdk/anthropic using bundled provider
...
"statusCode":401
"responseBody":"{\"error\":{\"message\":\"You didn't provide an API key. You need to provide your API key in an Authorization header using Bearer auth (i.e. Authorization: Bearer YOUR_KEY).\",\"type\":\"invalid_request_error\",\"code\":401}}"
ERROR service=session.processor error=Unauthorized

Failure tail:

"statusCode":401
"responseBody":"{\"error\":{\"message\":\"You didn't provide an API key. You need to provide your API key in an Authorization header using Bearer auth (i.e. Authorization: Bearer YOUR_KEY).\",\"type\":\"invalid_request_error\",\"code\":401}}"
ERROR  service=session.processor error=Unauthorized stack=AI_APICallError: Unauthorized
Error: Unauthorized: {"error":{"message":"You didn't provide an API key. You need to provide your API key in an Authorization header using Bearer auth (i.e. Authorization: Bearer YOUR_KEY).","type":"invalid_request_error","code":401}}

Control Experiment

Using the same key, same environment, same Claude model, and same prompt, but switching only the provider implementation to @ai-sdk/openai-compatible:

& 'C:\Users\Roger\AppData\Local\opencode\opencode-cli.exe' run --model ofox-openai-check/anthropic/claude-haiku-4.5 --print-logs 'Reply with OK only.'

Result:

OK

Successful tail:

OK
INFO  service=state key=F:\Project\AIBuilder\OpenCodeTest state disposal completed
INFO  service=server event disconnected

What This Rules Out

This control experiment rules out:

  • invalid API key
  • unavailable Claude model
  • broken project directory or HOME setup
  • config file not being loaded
  • Ofox service being completely unavailable

Conclusion

This does not look like a config discovery problem. It looks like a runtime auth propagation problem in OpenCode's handling of custom native Anthropic providers.

More specifically, the evidence supports the following:

  • the custom provider is discovered correctly
  • the runtime request goes through the bundled @ai-sdk/anthropic path
  • the configured options.apiKey does not make it into the final request correctly

Suspected Investigation Areas

  • whether options.apiKey is dropped somewhere between config resolution and request creation
  • whether the bundled provider path still applies built-in auth behavior intended for first-party Anthropic setup
  • whether custom baseURL support for native providers is incomplete

Activity

  1. github-actions
    assigned
    rekram1-node
    on Apr 9, 2026
  2. github-actions
    added
    coreAnything pertaining to core functionality of the application (opencode server stuff)
    windows
    on Apr 9, 2026

  3. github-actions commented on Apr 9, 2026

    @github-actions
    github-actionsBot
    on Apr 9, 2026 – with GitHub Actions
    Contributor

    This issue might be a duplicate of existing issues. Please check:

  4. tpwcnls commented on Apr 9, 2026

    @tpwcnls
    tpwcnls
    on Apr 9, 2026
    Author

    This looks closely related to #21738.

    Both issues reproduce on Windows with OpenCode 1.4.2, both involve custom native providers with a custom baseURL, and both fail at runtime with the same 401 invalid_request_error about a missing API key. The matching control experiments succeed when switching only the provider implementation to @ai-sdk/openai-compatible.

    This may indicate a shared runtime auth propagation bug affecting custom native provider handling.

  5. tpwcnls commented on Apr 10, 2026

    @tpwcnls
    tpwcnls
    on Apr 10, 2026
    Author

    Update after further investigation:

    The earlier "runtime auth propagation" conclusion now looks incomplete.

    The root cause appears to be the proxy endpoint path, not just API key propagation.

    For Ofox native endpoints, the working base URLs need to include the protocol-specific version segment:

    • Anthropic: https://api.ofox.ai/anthropic/v1
    • Gemini: https://api.ofox.ai/gemini/v1beta

    Using incomplete paths such as:

    • https://api.ofox.ai/anthropic
    • https://api.ofox.ai/gemini

    can trigger a misleading 401 invalid_request_error saying the API key was not provided.

    So the current best understanding is:

    • OpenCode may not be the root cause here
    • the more direct cause is that the native proxy baseURL must include the correct versioned path
    • otherwise the request hits the wrong proxy route and returns a misleading auth error

    Please treat my earlier auth-propagation diagnosis as provisional. The stronger current explanation is incorrect endpoint pathing for the native proxy.

  6. thdxr
    removed
    windows
    coreAnything pertaining to core functionality of the application (opencode server stuff)
    on May 3, 2026
  7. thdxr
    assigned
    nexxeln
    and unassigned
    rekram1-node
    on May 3, 2026

  8. ajangsupardi commented on Jun 8, 2026

    @ajangsupardi
    ajangsupardi
    on Jun 8, 2026

    I can confirm this also affects FreeModel (third-party Anthropic/OpenAI compatible provider).

    In v1.16.2, when configuring FreeModel with custom baseURL and apiKey:

    • @ai-sdk/anthropic with custom api: response received but content is blank (no error logged)
    • @ai-sdk/openai-compatible with custom api: 403 Unauthorized (API key not sent)

    API works perfectly via curl with both endpoints. The bundled SDK providers do not propagate the configured apiKey/baseURL to the actual HTTP requests.

  9. guenhter commented on Jul 24, 2026

    @guenhter
    guenhter
    on Jul 24, 2026

    This happens as well for 1.18.4

  10. codemug commented on Aug 5, 2026

    @codemug
    codemug
    on Aug 5, 2026

    Still happening in 1.18.13

  11. github-actions commented on Oct 6, 2026

    @github-actions
    github-actionsBot
    on Oct 6, 2026 – with GitHub Actions
    Contributor

    To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.

  12. github-actions
    closed this as not plannedon Oct 6, 2026

  13. opencode-agent commented on Oct 6, 2026

    @opencode-agent
    opencode-agentBot
    on Oct 6, 2026 – with OpenCode Agent
    Contributor

    Following up since this was auto-closed. This isn't an OpenCode auth bug.

    As @tpwcnls found in #21737 (comment), the problem is the baseURL. The Anthropic provider adds /messages to the end of baseURL. The default is https://api.anthropic.com/v1, so a proxy URL needs the version segment too:

    "baseURL": "https://api.ofox.ai/anthropic/v1"

    With https://api.ofox.ai/anthropic, the request goes to /anthropic/messages. The proxy doesn't route that path and responds with a misleading 401 saying no API key was provided, even though the configured apiKey is being sent as the x-api-key header. The Gemini case in #21738 is the same thing: that endpoint needs /v1beta.

    If you're hitting this on a newer version, first check that your baseURL exactly matches the Anthropic-compatible base URL your provider documents, including /v1. If it does and you still get a 401, please open a new issue with your config (key redacted) and the --print-logs output.

    Also: v2 swaps the AI SDK for our own provider layer, and it should behave better all around.

  14. celeste1900 commented on Oct 15, 2026

    @celeste1900
    celeste1900
    on Oct 15, 2026

    Update from the Ofox side: the misleading 401 described here is fixed as of 2026-10-15. A request to an unrouted path such as https://api.ofox.ai/anthropic/messages now returns a 404 whose message lists the correct base URLs (/v1, /anthropic/v1, /gemini/v1beta), so a wrong baseURL is no longer misdiagnosed as a dropped API key. The working config remains "baseURL": "https://api.ofox.ai/anthropic/v1".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions