Repository navigation
auth: opencode-go uses the Console credential instead of its own, causing spurious GoUsageLimitError #52374
Description
Description
With both an opencode (Console) credential and an opencode-go credential stored, opencode-go requests authenticate with the Console key and carry x-opencode-org-id of the Console workspace — instead of using their own oc_sk_… key with no org header.
That Console workspace has its Go monthly quota at 100%, so every Go call fails with:
429 {"error":{"type":"GoUsageLimitError","message":"Go usage limit exceeded"},
"metadata":{"limitName":"monthly"}}
while the same call made manually with the Go key succeeds (/zen/go/v1/usage → monthly 38%).
Capture of the real outgoing request (via a local server set as provider.opencode-go.options.baseURL), running opencode run --standalone --model opencode-go/deepseek-v4.1-flash:
| Credentials in store | Authorization sent by opencode-go |
x-opencode-org-id |
|---|---|---|
opencode-go only |
Bearer oc_sk_… ✅ |
absent |
opencode-go + opencode |
Bearer sk-… ❌ |
wrk_… |
Presence of the Console credential alone triggers it.
Not affected by: provider.opencode-go.options.apiKey (global or project — ignored), OPENCODE_API_KEY env set to the Go key (ignored), credential.active = 0 on the Console credential, credential label ordering, or opencode auth switch opencode-go.
Happens consistently. Both integrations declare the same env: ["OPENCODE_API_KEY"] in the models.dev catalog, which may be why the resolution falls back to the Console credential.
Workaround: opencode auth logout opencode "API key" — after that, opencode run --model opencode-go/deepseek-v4.1-flash "OK" succeeds. Free Zen models keep working without the Console credential, but there's currently no way to keep the Console credential and use opencode-go.
Plugins
None
OpenCode version
v2.0.20 (channel: latest)
Steps to reproduce
- Store two credentials:
opencode(Console,sk-…) andopencode-go(oc_sk_…). - Verify the Go key has quota:
curl -s https://opencode.ai/zen/go/v1/usage -H "Authorization: Bearer oc_sk_…"→200, monthly ~38%. - Verify the Console key's Go quota is exhausted: same request with
sk-…→ monthly{"status":"rate-limited","percent":100}. opencode run --standalone --model opencode-go/deepseek-v4.1-flash "OK"→Go usage limit exceeded.- Optionally point
provider.opencode-go.options.baseURLat a local capture server to see the wrongAuthorization+x-opencode-org-id.
Screenshot and/or share link
Unavailable: no share link, this is a local capture of the outgoing request headers.
Operating System
Nobara 44 (Fedora-based), Linux 7.2.0-200.nobara.fc44.x86_64
Terminal
xterm-256color, COLORTERM=truecolor (via SSH/agent shell)
Activity
github-actions commentedon Sep 30, 2026
This issue might be related to an existing issue. Please check:
vaprdev commentedon Oct 1, 2026
hey, we need to make the console/go authentication a bit clearer.
but you can use
/connect->opencode consoleto authenticate any console workspace, and it will include your go subs in the authentication. then you can use/connectagain to switch between the two workspaces and make calls (including go calls) from either.in v2 you don't need a go api key (the
opencode goauth method is a bit redundant currently)djbclark commentedon Oct 29, 2026
Still reproduces on opencode v2.2.1 (macOS), so this looks closed without a code change.
With both an
opencode(Console OAuth) credential and anopencode-gokey credential stored,opencode-go/*requests always authenticate with the active Console credential. Making theopencode-gokey active (opencode auth switch opencode-go <label>) and reloading the server (POST /api/location/reload) has no effect. We found this because a Console workspace hit its weeklyGoUsageLimitErrorwhile the active Go key belonged to a different account with quota left. The only thing that moved traffic was switching the active Console credential.Understood that v2 intends Go to ride on the Console sign-in (#50267, and the
/connect→opencode consoleadvice above). If so, two things would help:opencode auth switch opencode-go(or the Go key flow) look like it selects a credential that's then ignored, or warn when it's shadowed by a Console login.#57155 looks like it may cover both. Happy to test it.