opencode-proxycli-auth

opencode-proxycli-auth

An opencode plugin that adds a CliProxy login to the native anthropic provider, routing it through a self-hosted CLIProxyAPI ("proxycli") endpoint. The proxy owns your Claude accounts and does the Claude Code cloaking server-side, so every device just points at the same proxy: no per-device OAuth, add or remove accounts in one place (on the proxy server).

It also reuses @ex-machina/opencode-anthropic-auth when that package is present, keeping all of its Anthropic login methods and adding one more:

opencode auth login  ->  Anthropic
  Claude Pro/Max            (ex-machina, direct OAuth)
  Create an API Key         (ex-machina)
  Manually enter API Key    (ex-machina)
  CliProxy                  <- added by this plugin

ex-machina is loaded defensively at runtime. If it is missing or fails to load, the plugin still registers the anthropic provider with the CliProxy option plus a plain Manually enter API Key fallback, so the proxy login can never disappear because of a dependency problem.

Install

// ~/.config/opencode/opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "plugin": ["opencode-proxycli-auth"]
}

Use this plugin instead of adding @ex-machina/opencode-anthropic-auth separately: it already wraps it (loading both would make one silently win over the other). Then restart opencode.

Connect

opencode auth login

1. Pick Anthropic.
2. Pick CliProxy (the ex-machina methods are still there, unchanged).
3. Enter your CLIProxyAPI URL (e.g. http://127.0.0.1:8317), then your CLIProxyAPI api-key.

The plugin verifies the endpoint before saving: you get "Login successful" only when the proxy actually answers ("Failed to authorize" and nothing stored otherwise). Now anthropic/* runs through the proxy. Cost is zeroed (subscription-backed).

About the URL

Enter the proxy origin only (scheme + host + port). The plugin appends the Anthropic path (/v1/messages) itself, so you do not include it. A bare host:port works too (http is assumed), and a trailing /v1 or /v1/messages is stripped for you. If your proxy sits behind a path prefix (e.g. /claude), include just that prefix.

Notes

• One Claude account = one owner. Do not also log a proxied account into a client-side auth plugin elsewhere: the proxy must be the single owner (Claude rotates the refresh token, which would otherwise invalidate it).

Build

bun install
bun run build   # -> dist/index.js (+ dist/index.d.ts)

@ex-machina/opencode-anthropic-auth is an optional runtime dependency (kept external, resolved via a defensive dynamic import, not bundled). When present its methods are added to the menu; when absent the CliProxy option plus a manual API key fallback remain.

License

MIT (this plugin). @ex-machina/opencode-anthropic-auth is a separate package with its own terms.