CortexKit Claustrum Auth serves provider keys from a Claustrum vault to OpenCode 1, OpenCode 2 and Pi, for providers that need no special request handling. It is vault-only; use the dedicated openai-auth, anthropic-auth and antigravity-auth plugins for OpenAI/ChatGPT, Anthropic and Google Antigravity instead.
Quit OpenCode and Pi, then run:
npx @cortexkit/opencode-claustrum-auth setupSetup detects the hosts and registers the appropriate package: @cortexkit/opencode-claustrum-auth for OpenCode or @cortexkit/pi-claustrum-auth for Pi. Approve enrollment in ck auth to grant model-key read access in the same step on vaults that support it, then follow the printed provider activation commands. Older vaults need the manual grant command. See setup and activation for a dry run, host selection and the fallback grant step.
- Reads provider keys from the vault. It offers no local sign-in and stores no provider key on disk; the host keeps only a placeholder that holds no secret.
- Uses vault accounts in their set order, and moves to the next account on 401, 429 or a confirmed empty-balance 402 from DeepSeek or OpenRouter.
- Sends keys only as
Authorization: Bearerto allowlisted provider origins. - Provides a
/claustrumtext menu for vault status, account order, provider ownership and refusal reasons.
The entries below come from the provider table. Cells show the host's provider id; — means the plugin does not offer that provider on that host. Only models using bearer authentication are served, not every model in a provider's catalog.
| Provider | OpenCode 1 | OpenCode 2 | Pi |
|---|---|---|---|
| Cerebras | cerebras |
cerebras |
cerebras |
| Cline Pass | cline-pass |
cline-pass |
— |
| DeepSeek | deepseek |
deepseek |
deepseek |
| Fireworks | fireworks-ai |
fireworks-ai |
fireworks |
| Inception | inception |
inception |
— |
| Kimi Code | kimi-code-plan-global |
kimi-code-plan-global |
kimi-coding |
| MiniMax Token Plan | — | minimax-coding-plan |
— |
| Ollama Cloud | ollama-cloud |
ollama-cloud |
— |
| OpenRouter | openrouter |
openrouter |
openrouter |
| Synthetic | synthetic |
synthetic |
— |
| Meta | meta |
meta |
meta |
| xAI | xai |
xai (WebSocket by default) |
xai |
| OpenCode Go | opencode-go |
opencode-go |
opencode-go |
| OpenCode Zen | opencode |
— | opencode |
| Typesafe | Not in host catalog | Not in host catalog | — |
Typesafe has an allowlist entry, but the OpenCode 1 and OpenCode 2 catalogs checked for this release don't list it, so it can't be activated there until a catalog does. OpenCode 2 normally sends xAI over a guarded WebSocket handshake, not its HTTP request path; its HTTP fallback is also guarded. OpenCode Zen is not offered on OpenCode 2. Provider details records the catalog checks, exact origins, vault metadata and per-model restrictions.
- Setup and activation: enrollment, grants, host selection and activation.
- Commands: the
/claustrummenu, account ordering and ownership. - Providers: provider ids, host availability, origins and model restrictions.
- Security: bearer-only placement, origin checks, redirects and key scrubbing.
- Troubleshooting: refusal messages and recovery steps.
- OpenCode 1, OpenCode 2 and Pi integration: host-specific behaviour.
- Release: packaging and publishing.
MIT