OpenCode
Sign OpenCode in with a ChatGPT plan, GitHub Copilot or an API key, and what it uses in your terminals, in guests' shells and on your cloud boxes.
OpenCode can use several providers, each with its own sign-in. Two of them sign
you in with a subscription: a ChatGPT Plus or Pro plan through OpenAI, and
GitHub Copilot. GitLab Duo signs in with your GitLab account. Most others,
Anthropic included, take an API key. taiku uses whatever logins opencode
already has.
Sign in
On your own computer:
opencode providers loginPick a provider, then a way in:
| Provider | What it asks for |
|---|---|
| OpenAI | ChatGPT Pro/Plus (browser), ChatGPT Pro/Plus (headless) for a machine with no browser, or an API key |
| GitHub Copilot | Your GitHub account, on GitHub.com or GitHub Enterprise |
| OpenCode Zen | An API key from opencode.ai |
| GitLab Duo | Your GitLab account, or a personal access token |
| Anthropic | An API key. There is no Claude subscription sign-in in OpenCode. |
opencode providers list shows what is saved. OpenCode keeps every login in
~/.local/share/opencode/auth.json (under $XDG_DATA_HOME/opencode if you set
that). An opencode you start in a taiku terminal uses those logins, the same
as in any other terminal.
Use an API key instead
- Save the key as a login. In
opencode providers login, pick the provider and paste the key. It is saved with the other logins, so it works everywhere they do, includingtaiku agent --local opencode. - Export the key in your shell startup file. Put
export ANTHROPIC_API_KEY=...(or the provider's own variable, such asOPENAI_API_KEY) in~/.zshrcor~/.bashrc. taiku's shells run that file, so the key is there. On macOS and Linux, provider keys such asANTHROPIC_API_KEYandOPENAI_API_KEYthat you only exported in the terminal you started taiku from are not passed on; on Windows, taiku's shells keep your whole environment.taiku agent --localdrops those provider keys too (see below). It also stays out of a guest's sandboxed shell in the defaultisolatedmode, which does not run your startup files; atrustedsandboxed shell or one without the sandbox runs them, and gets the key.
Run it from taiku agent
taiku agent --local opencode --model anthropic/claude-sonnet-4-5This runs opencode on this machine with its saved logins, inside taiku's
sandbox. --model takes OpenCode's own provider/model names, as
opencode models lists them. taiku removes common provider keys such as
ANTHROPIC_API_KEY and OPENAI_API_KEY from its environment, so a model whose
provider you only have one of those for is reported as not found; save the key
with opencode providers login instead. Not every variable is removed:
OPENCODE_API_KEY and GITHUB_TOKEN, for example, still reach OpenCode.
Guests in your session
What a guest's shell gets from you depends on how it runs. Every sandboxed shell
the app opens for a guest on macOS or Linux runs in isolated mode.
| A guest's shell | Keys your startup files export | Your OpenCode logins |
|---|---|---|
Sandboxed, isolated | No | No, whatever --agent-credentials says |
Sandboxed, trusted (not offered in the app) | Yes | With --agent-credentials own-or-host, for guests who have not signed in; with host, for everyone; with the default, own, no |
| Without the sandbox: Ignore sandboxing, a session whose default is no sandbox, or a Windows host | Yes | The shell runs as you and can read them. --agent-credentials decides which logins opencode starts on: yours with own-or-host for guests who have not signed in, and with host for everyone |
With the default, own, a signed-in guest runs opencode on their own logins,
kept in a folder of theirs on your machine, and a guest who has not signed in
gets no agent. On a Windows host, own refuses a guest's opencode instead.
See
Guests use their own agent logins
and Guests on your machine.
On a cloud box
Boxes taiku runs for you come with opencode installed. On a machine you bring
over SSH, install it yourself.
taiku cloud copies your OpenCode settings and history to a Linux box, along
with your shell startup files. That includes ~/.config/opencode, so an API key
written into your OpenCode config there travels too. The node_modules folder
OpenCode fills when you log in to a provider stays behind.
From your saved logins in ~/.local/share/opencode/auth.json (and the older
~/.opencode/auth.json), it copies the API keys and adds them to the logins the
box already has. A sign-in such as ChatGPT Pro/Plus or GitHub Copilot stays on
this computer: it renews itself, so a copy would sign one of the two computers
out. taiku cloud --no-cloud-opencode-auth leaves OpenCode's files behind for
that run. To use a sign-in on the box, sign in there:
opencode providers loginOver SSH, pick ChatGPT Pro/Plus (headless) for a ChatGPT plan. An API key exported in your startup files reaches the box with them.
Hosted agents
The agents you keep on your account do not use your OpenCode logins. They call the model with an API key: the one this taiku holds, or your own under Settings → Agent → Model providers.
Gemini CLI
Sign Gemini CLI in with your Google account or a Gemini API key, and what it uses in your terminals, in guests' shells and on your cloud boxes.
Devices & remote access
Register your machines once, then start a taiku session on any of them from anywhere, with no SSH keys, VPN, or port forwarding.