Repository navigation
auth: Go API key creation is undiscoverable in the v2 Console and docs still say "copy your API key" #56498
Description
Summary
opencode-go authenticates only by API key — it declares no OAuth method — but the v2 Console no longer presents a discoverable way to create that key. The Go docs still instruct users to "copy your API key", which no longer matches the UI. A Go subscriber on a fresh machine has no working path to authenticate, and the dead end is not obvious because the OAuth device flow that opencode auth login opencode offers belongs to a different integration (opencode, Console) and fails independently with 429.
Environment
- opencode version:
v2.0.29(channel:latest) - OS: Linux 7.2.5-3-omarchy (linux x64)
- Terminal:
TERM=xterm-256color,COLORTERM=truecolor - Shell:
/usr/bin/bash - Install/channel: release (
latest) - Active plugins:
./plugins/jev
Reproduction
- Have an active OpenCode Go subscription whose API key expired or was deleted.
- Read the Go docs: "Sign in to the OpenCode Console, subscribe to Go or Go Plus, add your billing details, and copy your API key."
- Open the v2 Console. There is no Go API key visible, and the Keys page documents only service accounts minting
oc_sk_workspace keys. - Run
opencode auth loginand pick the offered OpenCode Console account method. - Observe
Authentication failed/429 POST https://opencode.ai/console/auth/device/code.
Expected Behavior
Either the v2 Console exposes a Go API key under a documented path, or the Go docs describe how to obtain one. A subscriber paying $10/month should be able to connect from a fresh install without reverse-engineering the UI.
Actual Behavior
opencode-go has no OAuth method. Verified against the running server:
{ "id": "opencode", "methods": [ "key", "env", { "id": "device", "type": "oauth" } ] }
{ "id": "opencode-go", "methods": [ "key", "env" ] }So the device flow is the wrong path for Go entirely, and nothing in the CLI or the docs says so. opencode auth login opencode — the path a Go subscriber is led to by the docs and by the connect picker — targets opencode, not opencode-go.
The device flow is separately rate limited, with no Retry-After:
POST https://opencode.ai/console/auth/device/code
Content-Type: application/json (also reproduced with form-urlencoded)
HTTP 429
{"_tag":"RateLimited","message":"Too many requests, please try again later"}
Reproduced 3/3 consecutive attempts from a single client with no prior burst, over a ~30-minute window, from both a curl client and the CLI. The client_id matches the one hardcoded in packages/opencode/src/account/index.ts ("opencode-cli"), so this is not a client-id mismatch — a bad client id returns 400. Form-encoded (the shape the v2 Console API docs show) and JSON (the shape the client sends) return identical 429s, so it is not a content-type issue. packages/opencode/src/session/retry.ts derives backoff from retry-after-ms / retry-after and falls back to a guessed exponential delay when they are absent; the Console is the party that knows the reset time and does not communicate it.
The key path works once a key exists, which is what makes this an onboarding bug rather than a backend bug. opencode auth login opencode-go --method key never touches the device endpoint and succeeds. Registering the key directly also succeeds:
POST /api/integration/opencode-go/connect/key {"key":"…"} → HTTP 204
Immediately after, inference works end to end:
opencode run --model opencode-go/deepseek-v4.1-flash → OK
opencode run --model opencode-go/muse-spark-1.3-contributor → OK
Additional Context
- The key is still creatable, but the path is obscure. A thread on linux.do describes it as: enter Settings, click your account name to reach a further screen, then click Create. Users there spent considerable time hunting for it. Another user on X was told to use the Keys tab and got a workspace key instead of a Go key.
- The Go docs still read "copy your API key", and the Console Go page still says "Once subscribed, copy your API key to connect OpenCode." Neither matches the v2 UI.
- Related open issues: Go API key is not available in the new v2 Console #52227, GO API key no longer found in the webiste #50180, NO API KEY #50885, [Bug] OpenCode Go subscription active but Go API key is not available in Console #52340, desktop: "Connect OpenCode Go" runs Console sign-in instead of the Go API-key flow, then reports success and fails with "Invalid credential" #52243, desktop: "Connect OpenCode Go" runs Console sign-in instead of the Go API-key flow, then reports success and fails with "Insufficient account funds" #50611, [Bug] OpenCode v2 cannot use OpenCode Go subscription, no models found in /model #50087. desktop: "Connect OpenCode Go" runs Console sign-in instead of the Go API-key flow, then reports success and fails with "Insufficient account funds" #50611 in particular documents the
connect/keyworkaround and reports the connect picker routing "OpenCode Go" to the Console OAuth flow. - The stale
opencode-gocredential could not be removed through the integration API — there is noDELETEroute under/api/integration/{integrationID}— and had to be removed viaopencode auth logout opencode-go <credentialID>. A disconnect affordance in the connect UI would help. - Happy to provide a
--print-logstrace or a HAR of the device-code request if useful.
Activity
opencode-agent commentedon Oct 17, 2026
Thanks for the detailed write-up, and for confirming that
opencode auth login opencode-go --method key/POST /api/integration/opencode-go/connect/keywork once you have a key.I think this is a duplicate of #52227: there's no discoverable way to create or copy a Go API key in the v2 Console, and the Go docs still say to "copy your API key".
Possible duplicates and closely related issues, ordered from most to least likely:
connect/keyworkaround.oc_sk_workspace keys, and Go users can't get a working key.The device-code
429withoutRetry-Afterand the missing disconnect/DELETEroute for integrations are separate from the main problem. Feel free to open focused issues for them.The bot will close this issue as a duplicate in 1 day unless you reply explaining how your problem is different.
lucasvidela94 commentedon Oct 17, 2026
Agreed, this is a duplicate of #52227 — I linked it in my own body, so I'd rather the discussion live there than split. Feel free to close this one.
Before it goes, three things verified here that #52227 does not yet have, in the hope they help whoever picks up the fix:
1.
opencode-godeclares no OAuth method at all. This is why the failure is so confusing. From the running server (opencode api get /api/integration):{ "id": "opencode", "methods": [ "key", "env", { "id": "device", "type": "oauth" } ] } { "id": "opencode-go", "methods": [ "key", "env" ] }So
opencode auth login opencode— the method the docs and the connect picker steer a Go subscriber toward — targets a different integration. Nothing in the CLI or the docs says the device flow does not apply to Go. For a subscriber who only knows "I need Go," that dead end reads as a broken backend rather than a wrong path, which is probably why a lot of the reports here are people concluding Go is broken.2. The backend is fine — it is purely onboarding. Once a key exists, both documented and undocumented routes succeed:
and inference works end to end immediately after:
3. Where the key actually is, per users who found it. A thread on linux.do describes the path as: open Settings, click your account name to reach a further screen, then click Create. Users there spent a long time hunting for it. Meanwhile a user on X was pointed at the Keys tab and got a workspace
oc_sk_key instead of a Go key. That split is consistent with #52243 / #51388 and is probably the concrete UI defect worth fixing.Smaller one: a stale
opencode-gocredential could not be removed through the integration API — there is noDELETEroute under/api/integration/{integrationID}— and had to be removed withopencode auth logout opencode-go <credentialID>. I'm filing that and the device-code429withoutRetry-Afteras separate focused issues, as suggested above.opencode-agent commentedon Oct 17, 2026
Thanks for confirming, and for the extra detail. The three points you added are useful for whoever picks this up:
opencode-godeclares onlykey/env, with no OAuth method, so the Console device flow can never connect Go.--method keyorconnect/key, and inference runs afterwards), so the gap is onboarding.oc_sk_workspace keys, as in desktop: "Connect OpenCode Go" runs Console sign-in instead of the Go API-key flow, then reports success and fails with "Invalid credential" #52243 and api key missing #51388.Since this issue will be closed in favour of #52227, please post a short version of these points as a comment on #52227. Otherwise they won't be on the thread people working on the fix will read. Linking the separate issues for the device-code
429withoutRetry-Afterand the missing integration disconnect/DELETEroute there would help as well.The bot will close this one as a duplicate of #52227 as planned.
opencode-agent commentedon Oct 18, 2026
Closing this as a duplicate of #52227, as you agreed above. Updates on the missing Go API key in the v2 Console and the outdated "copy your API key" docs will be in #52227, so please follow that issue. If you haven't yet, posting your three findings there will help whoever works on the fix: Go has no OAuth method, the key path works end to end, and the Settings → account name → Create path for the Go key. Thanks for the thorough report.