Providers

Connect provider accounts you already pay for, such as Anthropic, OpenAI, or AWS Bedrock, and share their models with everyone in the workspace. Console stores the credential and serves each provider through its gateway, so members use the models without ever seeing the provider key. The same gateway is available to your own tools through the Providers API.

Owners and admins manage providers from the Providers tab. Members get the enabled models in OpenCode after running /connect.

Connect a provider

1. Open Providers and click Connect Provider.
2. Pick a provider from the catalog and enter its API key.
3. Optionally click Test connection, then click Save.

The catalog includes Anthropic, OpenAI, Google, xAI, DeepSeek, Mistral, Groq, OpenRouter, and many more. Catalog providers come with their models preconfigured.

Cloud providers

Cloud providers need a few extra details.

Custom providers

Click Add Custom Provider to connect any other endpoint, then add its models with Add Model.

Choose models

Open a provider to see its models. Only enabled models are available to members.

• Use the Enabled toggle to turn a model on or off.
• Turn on New models to enable models the provider adds in the future.

Edit models

Click a model to edit it. Changes are saved when you close the panel.

Custom pricing

Catalog models start with the provider’s list price. If you have negotiated pricing, for example a discount on your OpenAI contract, override the prices under Cost Tiers so usage reports and budgets match what you actually pay.

Prices you change are highlighted on the provider page. Use Restore default value on a field, or ⋯ › Restore… on the model, to return to the list price.

Add a Context tier when a model charges more above a context size, for example for prompts over 200K tokens.

Custom models

Click Add Model to add a model the catalog doesn’t include, with its Display name and Model ID. Use ⋯ › Duplicate… on an existing model to start from its settings.

OpenCode models

The Models tab manages the models Console provides, which are paid from workspace credits. It works like a provider page:

• Turn individual models on or off.
• Turn Free models off to block free models for the workspace.
• Turn New models on to enable new Console models automatically.

Disable the whole provider from ⋯ › Disable to use only your own providers.

Use in OpenCode

Members run /connect and choose the workspace. Each enabled provider appears as the workspace name followed by the provider name, and /models lists its enabled models.

Acme Inc. / Anthropic

Turn on Managed providers only in Settings › General to restrict OpenCode to the workspace’s providers for everyone.

Send identity

When a provider is a gateway you run, turn on Send identity on its page. Console then adds an x-opencode-actor header to every model request it sends there. The header names the member or service account behind the request, so your gateway can log or restrict requests by sender.

x-opencode-actor: eyJhbGciOiJFUzI1NiIsInR5cCI6Im9wZW5jb2RlLWFjdG9yK2p3dCIsImtpZCI6Ii4uLiJ9...

• It’s off by default, and changing the base URL turns it off.
• A provider still at its vendor’s own API, such as https://api.openai.com/v1, doesn’t show the setting, since the vendor ignores the header.
• Console removes any x-opencode-* header a client sends, so the only x-opencode-actor your gateway receives is the one Console signed.
• Test connection and model listing call GET <base URL>/models with the credential alone, so don’t require the header on that route.

Token

The header is a JWT that Console signs for each request.

A member’s request carries a payload like this:

{
  "iss": "https://opencode.ai/inference",
  "aud": "https://llm.example.com/v1",
  "sub": "user_...",
  "workspace_id": "org_...",
  "user_id": "user_...",
  "email": "ada@example.com",
  "session_id": "ses_...",
  "request_id": "019a6e8f-24a0-7b12-9c3d-4e5f6a7b8c9d",
  "iat": 1794500000,
  "exp": 1794500120
}

Verify the token

Console publishes its public keys at https://opencode.ai/inference/.well-known/jwks.json, served with Cache-Control: public, max-age=300. Check the signature, issuer, audience, type and age, then the workspace. This example uses jose.

import { createRemoteJWKSet, jwtVerify } from "jose"

const keys = createRemoteJWKSet(new URL("https://opencode.ai/inference/.well-known/jwks.json"))

export async function sender(request: Request) {
  const token = request.headers.get("x-opencode-actor")
  if (!token) throw new Error("Missing x-opencode-actor")
  const { payload } = await jwtVerify(token, keys, {
    issuer: "https://opencode.ai/inference",
    audience: "https://llm.example.com/v1",
    algorithms: ["ES256"],
    typ: "opencode-actor+jwt",
    maxTokenAge: "120s",
    clockTolerance: "5s",
  })
  if (payload.workspace_id !== "org_...") throw new Error("Another workspace")
  return payload
}

Set audience to the provider’s base URL as saved in Console, without trailing slashes, and replace org_... with the workspace ID from your Console URL. Console publishes a new signing key before it signs with it, so a verifier that looks keys up by kid, as createRemoteJWKSet does, keeps working through a rotation.

Disable or remove

Open the provider’s ⋯ menu:

• Disable hides the provider and its models from members but keeps its settings.
• Remove… deletes the provider and its models. The dialog shows who used it recently, and offers Disable instead.

To rotate a key, click the credential on the provider page and enter the new one.

Billing

The provider bills you for tokens; Console does not charge credits for them. Console still records each request and its cost using the model’s pricing, so usage reports and budgets include it.

To call a provider from your own tools instead of OpenCode, use the Providers API.