Free tools Windows power users keep installed
One-click scans. No signup required.
The safest way to store an API key in OpenCode is not to put the literal value in opencode.json, a Git repository, a shell startup file, a command line, or an AI transcript. Use opencode auth login for a provider account, or inject a key at runtime from a protected environment, file, CI secret store, or managed vault. For one developer, OpenCode’s account store or a permission-protected file can be sufficient. Teams and automation should use short-lived or narrowly scoped credentials delivered by a vault or CI secret manager.
OpenCode supports API-key, OAuth, command, and environment authentication. The choice determines where the secret rests, who can read it, whether access is logged, and how easily you can rotate it after exposure.
As an Amazon Associate I earn from qualifying purchases.
What “secure” means for a CLI API key
An API key is a bearer credential: anyone who obtains the usable value may be able to call the provider, spend your budget, or access data. Security therefore has several separate parts:
Recommended Free Tools
- At-rest protection: the key is stored in an account database, local file, operating-system keychain, vault, or CI secret store with access controls.
- Runtime protection: the value is available only to the process that needs it and for no longer than necessary.
- Scope: the provider credential has the least permissions, spending limit, and environment access required.
- Visibility: the key does not appear in source control, shell history, process listings, debug output, logs, prompts, or copied transcripts.
- Recovery: you can identify where it was used, revoke it quickly, issue a replacement, and update dependent services.
An environment variable is only a transport mechanism. A key placed in an environment can still be exposed by an overly permissive host, a diagnostic dump, a child process, or a CI log. A file reference keeps the value out of a configuration file, but the referenced file still needs operating-system permissions and a safe backup policy.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
OpenCode’s supported credential methods
OpenCode documents four ways to authenticate a provider:
| Method | Where the value is kept | How OpenCode uses it | Best fit |
|---|---|---|---|
| API key login | A saved account in OpenCode’s server SQLite database | OpenCode selects the saved account for the provider | A developer who wants OpenCode to manage a local provider account |
| OAuth login | An OAuth token in the same saved-account store | OpenCode refreshes or uses the account according to the provider flow | Providers that offer OAuth instead of a manually copied key |
| Command login | The result of a configured command is saved as an account | OpenCode obtains the credential through the command-based login flow | Integrations that expose a supported command authentication method |
| Environment | The server process environment | OpenCode reads the variable without creating a saved account | Launchers, CI jobs, temporary sessions, and external secret managers |
Use the documented authentication commands rather than editing credential files or the database:
opencode auth loginstarts a provider login.opencode auth listshows saved accounts and environment connections.opencode auth switchchanges the selected saved account.opencode auth logoutremoves a saved account.
Environment credentials are not saved accounts, so opencode auth logout cannot remove them. A saved account takes precedence over an environment connection for the same integration. If you set a new environment variable and OpenCode still uses an older key, inspect opencode auth list and switch or log out the saved account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Using OpenCode’s account store safely
For a single developer on a properly protected workstation, the built-in account workflow is usually the least error-prone option. It avoids pasting a key into a project file and gives OpenCode a supported way to select and remove credentials.
- Run
opencode auth loginand choose the provider and authentication method it presents. - Complete the provider’s key, OAuth, or command-based flow without copying the value into a document or chat.
- Run
opencode auth listto confirm which account or environment connection is active. - Use
opencode auth switchif more than one saved account exists and the wrong one is selected. - When the account is no longer needed, run
opencode auth logoutand revoke the provider credential if it should not be usable anywhere else.
Where OpenCode saves a logged-in key
OpenCode says saved API keys and OAuth tokens live in a server SQLite database. The usual local path is ~/.local/share/opencode/opencode.db. That path is not universal: XDG_DATA_HOME, the release channel, or OPENCODE_DB can change the location.
Protect the operating-system account that owns this database. Use a separate user account on shared machines, full-disk encryption where appropriate, screen locking, and backups with the same access controls as the live database. Do not copy the database into a repository, shared drive, issue attachment, or troubleshooting archive. Do not edit rows directly; an apparently successful edit can leave OpenCode unable to select or remove the credential.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
When the account store is the wrong choice
A saved account is tied to the local OpenCode server and its database. It is less suitable when a job must run on an ephemeral CI worker, several tools must consume the same rotating secret, or a security team needs centralized access records. In those cases, leave the account store unused and inject a credential for the specific process.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Injecting a key with OpenCode configuration
OpenCode supports substitutions that resolve a value when the configuration is read. The documented environment form is:
{
"provider": {
"openai": {
"options": {
"apiKey": "{env:OPENAI_API_KEY}"
}
}
}
}The literal key is absent from opencode.json; only the variable name is committed. The process that starts the OpenCode server must have OPENAI_API_KEY set, and that process environment must itself be protected.
A file substitution is useful when a local launcher or password manager writes a key to a dedicated file:
{
"provider": {
"openai": {
"options": {
"apiKey": "{file:~/.secrets/openai-key}"
}
}
}
}OpenCode documents both {env:VARIABLE_NAME} and {file:path}. Relative paths resolve from the configuration-file directory. Absolute paths can begin with / or ~. Keep a referenced file outside the repository, restrict it to the owning account, and exclude it from synchronized folders and broad backups. A file reference protects the configuration from containing the value; it does not protect a readable file.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Creating a protected local secret file
- Create a directory such as
~/.secretsoutside the project. - Restrict the directory and file to your operating-system account. On systems that support it, use permissions equivalent to owner read/write only.
- Write only the key, without labels, comments, or trailing diagnostic output, to the file referenced by
{file:...}. - Confirm that the project’s ignore rules cannot accidentally re-include the file if it is ever placed under a project directory.
- Test the provider connection, then ensure your shell, editor, backup tool, and support scripts do not print the file contents.
Runtime injection for private servers and services
For a one-off private server, pass the provider variable only to the process that needs it. OpenCode’s documented pattern is:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
ANTHROPIC_API_KEY=... opencode --standaloneDo not replace the ellipsis with a value copied into a shared command history or a script committed to Git. Have a protected launcher or secret manager supply the variable at execution time. Avoid command-line arguments for secrets: other users and diagnostic tools may be able to inspect process arguments, while a variable can be scoped to the child process.
For the shared background server, OpenCode provides:
opencode service set env NAME VALUERemove a service environment value with:
opencode service unset env NAMEBecause service environment connections are not saved accounts, they appear in opencode auth list but cannot be removed with opencode auth logout. Keep the service’s operating-system account and service configuration private, and use the provider’s own revocation controls when replacing a key.
Choosing between local auth, environment variables, files, and a vault
Use this decision path before choosing a storage method:
- One developer, one workstation: start with
opencode auth loginif a local saved account meets your access and backup requirements. - A launcher, password manager, or CI system can inject a value: use
{env:NAME}and provide the variable only to the OpenCode process. - A local file is unavoidable: use
{file:~/.secrets/name}, with owner-only permissions and no repository or shared-folder storage. - Several CLIs, environments, or people need a credential: use a managed vault or CI secret manager with scoped identities, access logs, rotation, and runtime injection.
| Approach | At-rest location | Runtime lifetime | Team audit and sharing | Headless CI | Primary exposure to control |
|---|---|---|---|---|---|
| OpenCode saved account | OpenCode server SQLite database | Available to the OpenCode server account | Primarily local operating-system access controls | Awkward on ephemeral workers | Database copies, workstation compromise, wrong account selection |
{env:NAME} |
Parent or service process environment | Normally limited to the launched process tree | Depends on the launcher or secret platform | Works well when CI injects masked variables | Shell expansion, process inspection, debug and CI logs |
{file:path} |
Referenced local file | Readable whenever OpenCode resolves the file | Usually local; sharing requires separate controls | Works if the runner securely materializes the file | File permissions, backups, sync tools, accidental commits |
| Managed vault or secret manager | Central secrets service | Can issue short-lived or on-demand values | Supports least privilege, access records, and service-account restrictions | Designed for headless jobs and workload identities | Vault policy, identity, and injection configuration |
A managed vault is not automatically safer merely because it is centralized. Its benefit comes from narrow policies, authenticated clients, audit records, revocation, and controlled delivery. A small team may reasonably use a password manager’s CLI or a CI provider’s encrypted secret store; a larger organization should define ownership, approval, and rotation procedures.
Applying the pattern to other CLI tools
AWS, GitHub, cloud, database, and vendor CLIs generally follow the same design:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Commit a non-secret configuration template containing variable names or secret references.
- Retrieve the real value from a vault, password manager, OS keychain integration, or CI secret store immediately before execution.
- Expose it only to the child process that needs it.
- Prevent verbose, debug, and error output from printing request headers or environment values.
- Use separate credentials for personal work, development, staging, and production.
One concrete implementation is the 1Password CLI. Its op run command loads secret references and provides environment variables to a child process rather than writing plaintext values into the script. Its related commands include op read and op inject; shell plugins and service accounts can be restricted to specific vaults. This pattern is useful because the script contains references, while the running process receives the value only when needed.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsGitGuardian’s command-line guidance states: “Never enter or store passwords, API keys or any other secrets in plaintext.” Treat that as a rule for source files, command history, issue trackers, terminal recordings, support bundles, prompts, and transcripts, not just for the main configuration file.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Preventing leaks in Git, shells, logs, and AI conversations
Repository controls
- Never commit a real key, even briefly. Removing it in a later commit does not erase it from existing clones, forks, caches, or object databases.
- Keep examples syntactically valid but nonfunctional, such as
OPENAI_API_KEYas a variable name rather than a realistic token. - Store local secret files outside the project. If a tool requires a project-relative path, add the file to ignore rules before creating it and verify the ignore result.
- Use secret scanning in the repository and CI pipeline, but do not treat a clean scan as proof that a key is safe.
Shell and process controls
- Do not type a literal key into a command that will be saved in history.
- Do not pass secrets as positional command-line arguments when an environment or file descriptor mechanism is available.
- Disable or constrain shell tracing and verbose modes around secret retrieval.
- Check that wrappers, crash reporters, process monitors, and “print environment” diagnostics cannot capture the value.
Logs, prompts, and transcripts
- Redact authorization headers, environment dumps, request payloads, and provider error objects before sharing logs.
- Do not paste a key into an AI prompt, coding session, issue, chat, screenshot, or terminal recording. Context retained by a tool may be copied or viewed by people who should not have provider access.
- When asking for help, provide the command shape, variable name, error text, and a redacted prefix or fingerprint only if support specifically requires identification.
OWASP guidance recommends dedicated secrets storage and management for client credentials and API keys, and warns against plaintext code and uncontrolled exposure through logs or environment handling. Follow the stricter rule when a tool’s behavior is unclear: assume diagnostic output can contain inputs until you have verified otherwise.
Least privilege, separation, and rotation
Storage cannot compensate for an overpowered credential. Create provider keys with the narrowest permissions and budgets available. Separate personal, work, development, staging, and production credentials so a local experiment cannot spend a production budget or read unrelated data. Prefer service accounts for automation, with only the APIs and projects that job requires.
Set a rotation interval appropriate to the provider and risk. A rotation should create the replacement, deploy it, verify the dependent OpenCode server or CLI, and then revoke the old value. Do not leave both keys active indefinitely merely because replacement was inconvenient.
If a key may have been exposed
- Revoke or disable the key at the provider immediately; do not wait for repository cleanup.
- Check provider usage, billing, and access logs for activity you do not recognize.
- Remove the value from the exposed repository, issue, log, prompt, or transcript, understanding that deletion may not remove historical copies.
- Issue a new, narrowly scoped credential and deliver it through the approved runtime mechanism.
- Update every OpenCode server, service, CI job, and other CLI that used the old key.
- Review how the exposure happened and add a control such as secret scanning, masked CI output, permission changes, or a vault policy.
Headless CI and team operation
CI jobs should obtain secrets through the CI platform’s protected secret mechanism or a vault identity assigned to the workload. The job should inject the value only into the OpenCode or CLI process, mask it in logs, and prevent pull requests from untrusted code from reading production credentials. Prefer short-lived credentials or a service account limited to the specific repository, project, provider operation, and budget.
For teams, document who owns each credential, which environments use it, how access is approved, how often it rotates, and which logs prove use. A shared static key copied into several developer machines is difficult to audit and impossible to rotate cleanly. Individual identities or restricted service accounts make revocation and investigation more precise.
Troubleshooting OpenCode credential selection
OpenCode keeps using an old key
Run opencode auth list. A saved account takes precedence over an environment connection for the same provider. Use opencode auth switch to select the intended saved account, or opencode auth logout to remove the saved account before retrying the environment method.
The environment method is not visible
Confirm that the variable is set in the environment of the OpenCode server, not merely in a different terminal, editor, shell, or login session. For a standalone launch, place the assignment on the same command that starts OpenCode. For a background service, set it with opencode service set env NAME VALUE and restart or reconnect as required by that service.
A file substitution fails
Check whether the path is relative to the configuration-file directory or an absolute path beginning with / or ~. Verify that the server account can read the file, that the file contains only the intended value, and that permissions do not grant unrelated users access. Avoid printing the file while debugging.
Logout does not remove the credential
Environment connections are not saved accounts, so opencode auth logout cannot remove them. Unset the service or launcher variable with the mechanism that created it; for a background service, use opencode service unset env NAME. Revoke the provider key separately if it must stop working immediately.
A practical secure setup
For a personal workstation, log in with opencode auth login, protect the operating-system account and OpenCode database, and inspect opencode auth list whenever providers behave unexpectedly. For a project that must keep configuration in Git, commit only {env:NAME} or {file:~/.secrets/name} and protect the referenced source. For CI or a team using several CLIs, use a vault or CI secret manager to issue a scoped credential at runtime, mask logs, record access, and rotate on a defined schedule.
That arrangement keeps the secret out of the places most likely to be copied while preserving a clear path to selection, revocation, replacement, and incident response.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
