Connect OpenCode to the gateway with my keys
Your provider keys in one machine-home vault, one local connection for OpenCode, and rotation on 429 you never see.
Prompt#
Put my OpenAI key in orch and point OpenCode at the gateway.
What the Chair does#
Nothing — this one is yours. There is no MCP tool for it: the commands write a key vault and another app's config file, so they run once from a human terminal.
CLI#
orch gateway keys add openai # prompts for the key, probes it, then saves
orch gateway keys add openai sk-… # or pass it inline
orch gateway keys list # hints and tier only, never the key
orch gateway keys remove openai sk-…abcd
orch gateway # start the gateway first
orch gateway connect opencode # writes OpenCode's own config, automatically
orch gateway status # live/cooldown, ring position, rotations
Other agents print a one-time paste instead of being wired for you:
orch gateway connect commandcode, orch gateway connect openai,
orch gateway connect claude. orch gateway presets lists the upstream URLs orch
already knows.
Expected response#
keys add prints openai sk-…abcd: ok, added to the rotation ring, or
probe failed, not saved (…) — and saves nothing when the probe fails.
connect opencode prints Created or Updated OpenCode config → <path>, names the
provider (OrcheMax, default model orchemax/auto if you had none), and tells you to
restart OpenCode. It also sets ORCH_GATEWAY_KEY for this workspace.
Gotchas#
- Several keys per provider is a feature. Comma-separated keys are a rotation ring;
the gateway advances it on 429s and cooldowns by itself, so the agent never sees a
rate limit.
orch gateway statusshows where in the ring you are. - A key is never printed back.
add,listandremoveshow hints only (sk-…abcd), which is also how you address one inremove. addprobes before it saves. A typo'd or dead key is rejected at the prompt, not at the first request.- OpenCode is the only one wired automatically. The others print env for you to paste once — deliberate: orch does not rewrite config files it does not own.
- Restart OpenCode after connecting. The config is read at start.
- Claude Code is the exception on purpose. It keeps its own plan login
(
agents.auth.claude: account) and routes nothing through the vault. The gateway answers403to any request carrying an Anthropic OAuth bearer (sk-ant-oat…) or theanthropic-beta: oauth-2025-04-20header — Anthropic's terms forbid a third party intermediating those credentials. An Anthropic API key is the only Anthropic credential the passthrough lane carries. - Keys live in machine-home
keys.env, not inorch.yaml— one vault for every workspace on the machine, and nothing key-shaped in your repo.