Repository navigation
Config variables in opencode.json overwritten with actual values on start up #9086
Description
Description
I set api keys following guidance on variables in config files here. When I start opencode, the variables are overwritten with the actual value in opencode.json.
This defeats the purpose of using variables to keep secrets outside of opencode.json and makes it impossible to commit opencode.json as it can expose secrets.
Plugins
No response
OpenCode version
1.1.25
Steps to reproduce
- Use the
envvariable inopencode.jsonfor a provider API key. - Start opencode.
- Reload
opencode.jsonto see if the variable was replaced with the actual value.
Screenshot and/or share link
No response
Operating System
Ubuntu 25.10
Terminal
Ubuntu terminal
Activity
github-actions commentedon Jan 17, 2026
This issue might be a duplicate of or related to existing issues. Please check:
{env:...}variable substitution inconsistently fails for specific MCP server URLs #5299: {env:...} variable substitution inconsistently fails for specific MCP server URLsThese issues all relate to how environment variables and secrets are handled in configuration files. If your case is specific to the overwriting behavior you described, it may be a distinct bug worth investigating separately.
Feel free to ignore if none of these address your specific case.
cravenceiling commentedon Jan 17, 2026
I couldn't reproduce this. Where is your
opencode.jsonfile? Also, what is the output ofopencode debug config? Does your api key appear there?spenceforce commentedon Jan 17, 2026
This happens in
.config/opencode/opencode.jsonand my project specificopencode.json. I put the{env:API_KEY}back and when I opened opencode it didn't change it. But when I removed"$schema": "https://opencode.ai/config.json"fromopencode.jsonand restarted opencode, it replaced the variable again. I assume it reads the config, then rewrites it if"$schema": "https://opencode.ai/config.json"is missing and writes the values for each field instead of the original string.rekram1-node commentedon Jan 17, 2026
yes that is the case, if that schema field is missing
spenceforce commentedon Jan 17, 2026
Ok, thats a security issue. Opencode should never write secrets to its config files. I find it odd that it rewrites my config at all instead of using a default value for
"$schema"considering it uses default values for everything else.rekram1-node commentedon Jan 18, 2026
fixed: 052f887
spenceforce commentedon Jan 18, 2026
Awesome, thank you!
github-actions commentedon Mar 27, 2026
To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.