@openprojectx/opencode-kimi-auth

OAuth login for Kimi Code (subscription) in opencode — use Kimi K3 / K2.7 Code via opencode auth login browser sign-in, no manual API key needed.

Why

opencode's built-in kimi-for-coding provider only supports API keys. If you have a Kimi Code membership (subscription), your sign-in is OAuth-based — pasting a Moonshot platform key gets you 401 Unauthorized (see docs/kimi-opencode-troubleshooting.md).

This plugin adds the same OAuth device flow that kimi CLI and pi use:

opencode auth login → Kimi For Coding → Sign in with Kimi Code (subscription)
→ open URL, enter code → done

Install

// opencode.jsonc (project) or ~/.config/opencode/opencode.jsonc (global)
{
  "plugin": ["@openprojectx/opencode-kimi-auth"]
}

Then:

opencode auth login   # → Kimi For Coding → "Sign in with Kimi Code (subscription)"
opencode models       # → kimi-for-coding/k3, kimi-for-coding/kimi-for-coding, …

Models

Model	Description	Context
kimi-for-coding/k3	Kimi K3 — flagship, reasoning (recommended)	1M tokens
kimi-for-coding/k3-256k	Kimi K3, smaller context variant	256K
kimi-for-coding/kimi-for-coding	Kimi K2.7 Code	256K
kimi-for-coding/kimi-for-coding-highspeed	K2.7 Code, faster/more expensive	256K

Select interactively with /models in the TUI, or set a default:

{
  "plugin": ["@openprojectx/opencode-kimi-auth"],
  "model": "kimi-for-coding/k3"
}

How it works

Step	Detail
Login	RFC 8628 device authorization grant against https://auth.kimi.com (/api/oauth/device_authorization → poll /api/oauth/token). Official public client ID (same as MoonshotAI's kimi-cli).
Token use	Authorization: Bearer <access_token> against https://api.kimi.com/coding/v1 (Anthropic Messages API). The plugin's custom fetch strips the x-api-key placeholder and injects the Bearer header.
Refresh	Access tokens live ~15 minutes. The plugin refreshes proactively when <5 min remain, single-flights concurrent refreshes, retries 429/5xx with backoff, and persists rotated tokens back to opencode's auth store.
Expired refresh token	invalid_grant/401/403 → error tells you to run opencode auth login again.

API keys still work — the plugin registers both login methods, so opencode auth login → Kimi For Coding shows a menu: "Sign in with Kimi Code (subscription)" or "Manually enter API Key". The KIMI_API_KEY env var also keeps working independently of both.

Configuration

Env var	Default	Purpose
KIMI_CODE_OAUTH_HOST	https://auth.kimi.com	Override OAuth host (also reads KIMI_OAUTH_HOST)
KIMI_API_KEY	—	Built-in API-key auth (unchanged, no plugin needed)

Develop

bun install
bun test          # unit tests (device flow, polling, refresh retry logic)
bun run typecheck

Release flow: changesets — bunx changeset to add a changeset; merge to master and the release workflow opens a version PR / publishes to npm (requires NPM_TOKEN secret).

References

• Technical evaluation & design: docs/kimi-oauth-evaluation.md
• Raw endpoint probes: docs/kimi.http
• Official flow source: MoonshotAI/kimi-cli src/kimi_cli/auth/oauth.py
• pi implementation: packages/ai/src/auth/oauth/kimi-coding.ts

License

MIT