Merge c307b124a1 into 83397ebde2

packages/opencode/src/provider/provider.ts

@@ -660,6 +660,14 @@ export namespace Provider {
       const providerID = plugin.auth.provider
       if (disabled.has(providerID)) continue
 
+      // Skip OAuth/plugin auth if config explicitly sets an apiKey for this provider
+      const configProvider = config.provider?.[providerID]
+      const hasExplicitApiKey = configProvider?.options?.apiKey !== undefined
+      if (hasExplicitApiKey) {
+        log.debug("skipping plugin auth loader - config has explicit apiKey", { providerID })
+        continue
+      }
+
       // For github-copilot plugin, check if auth exists for either github-copilot or github-copilot-enterprise
       let hasAuth = false
       const auth = await Auth.get(providerID)

packages/opencode/test/provider/provider.test.ts

@@ -1807,3 +1807,35 @@ test("custom model inherits api.url from models.dev provider", async () => {
     },
   })
 })
+
+test("config apiKey takes precedence over OAuth plugin auth loaders", async () => {
+  await using tmp = await tmpdir({
+    init: async (dir) => {
+      await Bun.write(
+        path.join(dir, "opencode.json"),
+        JSON.stringify({
+          $schema: "https://opencode.ai/config.json",
+          provider: {
+            anthropic: {
+              options: {
+                apiKey: "explicit-config-api-key",
+              },
+            },
+          },
+        }),
+      )
+    },
+  })
+  await Instance.provide({
+    directory: tmp.path,
+    fn: async () => {
+      const providers = await Provider.list()
+      expect(providers["anthropic"]).toBeDefined()
+      // When config has explicit apiKey, it should be used
+      // and plugin auth loaders should be skipped (no OAuth processing)
+      expect(providers["anthropic"].options.apiKey).toBe("explicit-config-api-key")
+      // Source should be "config" since config is merged last
+      expect(providers["anthropic"].source).toBe("config")
+    },
+  })
+})