add ability to load secrets from external command or environment variables in the config file

I have all my dotfiles in a github repository. I want the opencode configuration to be part of my dotfiles. I am using github mcp which requires the github personal access token so I cant commit the file.

Can we make the config file to

evaluate environment variables OR
evaluate command (eg pass)

i believe opencode will load .env files - does that help? typically we try to avoid too much env loading as people always have complex wasy they want to load the env

can you ensure the env is loaded before opencode starts? if not we can figure something out

@thdxr

Actually, I ended up doing it differently which works perfectly for my use case. I added a bash script that uses pass to dynamically load the github token, then use the base script as local tool.

Example for others who run into similar issue

# /home/user/.config/opencode/commands/github
#!/bin/bash
TOKEN=$(pass personal/github_token)
docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN=$TOKEN ghcr.io/github/github-mcp-server

"mcp": {
    "github": {
        "type": "local",
        "command": ["/home/user/.config/opencode/commands/github"]
    }
}

@thdxr i did not try the .env route. I had the variable loaded in my shell via .zshrc and it did not work. The script solution works fine for my usecase, so feel free to close this issue if you dont want to investigate further into environment variables.

See also #318 and #342.

I'm also having the same issue with .zshrc -- I have my .env sourced, with all values printable in my terminal, but they arent being loaded in opencode:

expected:

"context7": {
      "type": "remote",
      "url": "https://mcp.context7.com/mcp",
      "headers": {
        "CONTEXT7_API_KEY": "{env:CONTEXT7_API_KEY}"
      },
      "enabled": true
},

opencode debug config:

"context7": {
      "type": "remote",
      "url": "https://mcp.context7.com/mcp",
      "enabled": true,
      "headers": {
        "CONTEXT7_API_KEY": ""
}

the API key is printable in my shell.

Merge branch 'shuvcode-dev' into integration

https://github.com/olimorris/codecompanion.nvim uses a syntax like this {cmd:pass some-token} which is quite nice.

I agree this feature will be pretty helpful, because in this way I can e.g. use 1Password cli to retrieve secrets, and never store the secrets locally.

right now i am using an approach where i put all my keys inside .secrets directory and use file references {file:./.secrets/xxx.key} to inject them. this way i can commit my opencode config to my private remote repo

opencode will load .env files

Heads-up: the packaged CLI currently does NOT auto-load project .env files. It only reads existing environment variables.

Dev build sets autoloadDotenv: false, and earlier builds used --env-file="".

So {env:VAR} resolves only if the env var is already set before opencode starts. The docs line about project .env looks outdated.

@thdxr

Did not found this issue before, so i closed mine.

Here is the associated PR: #8917

@thdxr do you mind taking a look at it?

To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.

For those looking to a coding agent that supports this:

crush
pi
mistral-vibe (only partially, ie. it can load a .env)

For those looking to a coding agent that supports this:

crush

pi

mistral-vibe (only partially, ie. it can load a .env)

How does crush support this? This would resolve charmbracelet/crush#2334

feat: improve owpenbot WhatsApp onboarding (anomalyco#231)

This should be reopened and expanded:

Beyond just secrets management, as an example, external tools may be needed to recompute authentication credentials for MCPs. Supporting something like calling $(gcloud auth print-access-token) for every connection establishment towards an MCP would be great. The bearer token expires hourly (though seemingly slightly adjustable).

feat(es-app): size distribution and neutral notes on coalesced tool r…

fix(es-app): wrap coalesced size distribution at narrow widths (anoma…

fix(es-app): keep size distribution bins whole when wrapping (anomaly…

Navigation Menu

Repository navigation

add ability to load secrets from external command or environment variables in the config file #231

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

add ability to load secrets from external command or environment variables in the config file #231

Description

Activity

thdxr commented on Jun 20, 2025

adikari commented on Jun 20, 2025

aspiers commented on Jun 28, 2025

caleb-reyes-op commented on Dec 15, 2025

betaboon commented on Jan 14, 2026

evannotfound commented on Jan 17, 2026

liby commented on Jan 19, 2026

nikaro commented on Jan 20, 2026

github-actions commented on Mar 26, 2026

nikaro commented on Mar 26, 2026

malikwirin commented on Apr 9, 2026

ivucica commented on Jul 30, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions