Plugin can't read raw 'Claude Code' Keychain service (Anthropic console API key)

[hypeitnow]

Resolved by @hypeitnow/opencode-claude-auth@1.6.14 (npm) / hypeitnow/opencode-claude-auth@e273493 (mirror main). The fix takes a different path than the originally-proposed one below — see comment for the full update. End-to-end verified on this Mac with haiku-4-5, sonnet-4-5, opus-4-1. 253/253 tests pass. Closing-ready; willing to push directly if push access is granted.

---

Original report

The claude CLI stores the Anthropic console API key as a raw sk-ant-api03-... string in the macOS Keychain service Claude Code (no JSON envelope, no -credentials suffix). This plugin only reads services matching Claude Code-credentials*, so on machines where the user signed in via claude auth login and got a console API key, the plugin prints:

No Claude Code credentials found. Running in API key mode with transform hook enabled.

Proposed fix (superseded)

Mirror with fix + tests + README update is published at:

• hypeitnow/opencode-claude-auth main branch, tip c041ede (now e273493)
• 6 commits on top of v1.5.4:
  • 2713d40 feat: read raw 'Claude Code' Keychain entry as long-lived API key
  • ac9e774 build: add prepare script so bun install builds dist
  • 9ea790a build: invoke tsc via node so prepare works without PATH lookup
  • df296ca build: portable build.mjs that resolves tsc via createRequire
  • c041ede build: commit pre-built dist so GitHub installs work without devDeps
  • f60dd76 Merge branch 'feat/claude-code-raw-keychain-fallback'

Diff summary (src/keychain.ts)

const RAW_KEY_SERVICE = "Claude Code"
const RAW_KEY_DEFAULT_TTL_MS = 365 * 24 * 60 * 60 * 1000

function parseRawApiKey(raw: string): ClaudeCredentials | null {
  const trimmed = raw.trim()
  if (!trimmed) return null
  if (!trimmed.startsWith("sk-ant-")) return null
  return {
    accessToken: trimmed,
    refreshToken: "",
    expiresAt: Date.now() + RAW_KEY_DEFAULT_TTL_MS,
  }
}

function parseCredentials(raw: string): ClaudeCredentials | null {
  let parsed: unknown, parsedAsJson = true
  try { parsed = JSON.parse(raw) }
  catch { parsedAsJson = false; parsed = null }

  if (!parsedAsJson) {
    return parseRawApiKey(raw)  // NEW fallback
  }
  // ...existing JSON path unchanged
}

• listClaudeKeychainServices() also matches bare Claude Code (separate regex after the OAuth one).
• writeBackCredentials() short-circuits (returns false) when source === "Claude Code" to avoid overwriting the raw key with a JSON envelope.
• 8 new tests added (4 parse, 3 service discovery, 1 writeback no-op). 47/47 keychain tests pass; 229/229 total.

Verified end-to-end

Plugin's readAllClaudeAccounts() against real macOS keychain on the mirror:

{
  "accounts found": 1,
  "label": "Claude",
  "source": "Claude Code",
  "accessPrefix": "sk-ant-api03-1R3Y_lxg2vmD...",
  "refreshEmpty": true,
  "expiresInDays": 365,
  "subscriptionType": null
}

Why not a fork PR?

The repo was mirrored as a regular public repo (not via gh repo fork) because of EMU restrictions. GitHub's PR API rejects cross-repo PRs when neither side is a fork. Happy to push the branch to this repo directly if you grant push access, or to provide a .patch file / cherry-pick commands.

cc @griffinmartin

[hypeitnow]

Update — the proposed fix above is superseded by 1.6.14

TL;DR: the original "write raw key as oauth envelope" path was a dead end — the Anthropic API rejects raw sk-ant-api03-... console keys sent as Bearer (401 Invalid bearer token), regardless of which plugin wrote them. Direct curl with the same key + x-api-key header returns 200 OK. The key was always valid; only the auth path was wrong.

1.6.14 — write raw key as type: "api" instead

Published as @hypeitnow/opencode-claude-auth@1.6.14 on npm. Mirror tip on hypeitnow/opencode-claude-auth:main is now e273493 (was c041ede when this issue was filed).

The fix changed two things in src/credentials.ts + src/index.ts:

1. syncToPath writes raw keys (!creds.refreshToken) as {"type":"api","key":<key>} so opencode's loader takes the native x-api-key path — not Bearer.
2. The loader returns {apiKey: auth.key} when auth.type === "api" so opencode sends the standard x-api-key header natively (the existing experimental.chat.system.transform hook still adds the Claude Code identity prefix).
3. syncToPath now preserves any existing type:"api" entry — does not clobber a key the user configured manually.

Verified end-to-end (this Mac, 2026-06-02)

opencode run -m anthropic/claude-haiku-4-5  "Reply with just OK"        → OK
opencode run -m anthropic/claude-sonnet-4-5 "Reply with just SUCCESS"  → SUCCESS
opencode run -m anthropic/claude-opus-4-1   "Reply with just GREAT"    → GREAT

All with plugin enabled, no manual auth.json editing, no OAuth flow.

Tests

253/253 pass (was 229/229). Added 1 new test for type:api preservation; updated 1 test for the new write format.

OAuth fallback (added in 1.6.13) — kept as fallback, no longer needed for this user

Implemented PKCE OAuth via ex-machina client_id 9d1c250a-e61b-44d9-88ed-5944d1962f5e (6 registrable scopes). OAuth login succeeds and returns real tokens, but the API rejects them with 403 OAuth token does not meet scope requirement any_of(user:inference, user:developer, user:ccr_inference, user:voice, org:service_key_inference, workspace:developer, workspace:inference). The 4 non-registrable scopes are server-rejected as "not registered with this application"; the issued token lacks user:inference (org policy). This path is still registered as an auth method for users who have a working OAuth setup, but the raw-key path is what works here.

DotCipher/opencode-claude-bridge (alternative, also works)

dotCipher/opencode-claude-bridge@1.10.11 takes a different approach: OAuth bridge with wire-matching (betas, x-anthropic-billing-header, cached full system prompt from ~/.cache/opencode-claude-bridge/claude-system-prompt.json, dynamic 3-char hex fingerprint). Falls back to reading the same raw Claude Code keychain value when no claudeAiOauth is present, writes it as type:"apikey" and sends as Bearer. Tested on this Mac — also returns 200. Not ported to this plugin because the 1.6.14 native-x-api-key path is sufficient and simpler.

Diff vs the originally-proposed fix

The proposed parseRawApiKey + service discovery changes in 1.6.0 are still in place and correct. The only behaviour change is syncToPath + loader: write as type:"api" (not as type:"oauth") and pass-through to opencode's native auth.

PR

Still happy to push directly if you grant push access to hypeitnow, or to provide a .patch / cherry-pick sequence from e273493. Or close this as resolved by 1.6.14 and let the npm release carry the fix.

cc @griffinmartin