OpenCode API Key Expired? What the Breach Did and the Fix
OpenCode's 'API key expired' error is not a timeout. A breach on October 17, 2026 killed keys. Here is what the errors mean and the five-step fix.
6 min read · Last updated: October 25, 2026
If OpenCode says "This API key has expired" (HTTP 401, code api_key_expired), your key probably did not age out. OpenCode reported a breach on October 17, 2026, and its own keys were cut off too. Sign in again with /connect, replace the key, then revoke any provider keys you saved in the Console.
Came here from Instagram, LinkedIn, X or YouTube? Here is the full source list you came for. Everything below is built from these, nothing else.
The announcement
- OpenCode's post on X, Oct 17, 2026 (the primary statement; I could not open it directly, so I rely on the write-ups below for its wording)
- Dax Raad (OpenCode) on X, Oct 18, 2026
- OpenCode status page
The receipts
The write-ups
Key takeaways
- OpenCode disclosed the breach on October 17, 2026. It says 1.4% of Console users were affected.
- The
api_key_expirederror is a 401 from OpenCode's backend. Your key likely was revoked, not timed out. - You have two separate problems: being locked out, and having provider keys exposed.
- Fix the lockout with
/connect. Fix the exposure by revoking keys at each provider, not only in OpenCode. - A stale key can hide in four places: an env var,
opencode.json,auth.json, or a running process. - A spend alert does not stop charges. Set a hard spending limit.
What happened in the OpenCode breach?
OpenCode, the open-source AI coding agent, said on October 17, 2026 that it suffered a security breach the night before. According to Elephas's summary of the disclosure, an unauthorized party accessed a legacy system OpenCode was decommissioning, and saved provider keys "may have been exposed."
OpenCode says 1.4% of Console users were affected, a subset who had external providers linked. It linked the incident to a "large scale distillation attack" but has not explained the link, and some researchers questioned the label. Dax Raad says the coding agent itself was not the breached system. The breach hit the hosted Console, an optional service.
Providers reacted. Per Elephas, Anthropic said it revoked Claude API keys it believed were affected. OpenAI said it worked with OpenCode to restore access and refund credits drawn during the attack. As of October 20, Google had made no public statement.
Why does it matter to a developer?
It matters because a key saved in a hosted tool is a key someone else can lose. If you linked OpenAI, Anthropic or Google keys to the Console, the damage is billed to you, at the provider, not at OpenCode.
Users reported real costs. aifreeapi lists about $20 of Anthropic credit used in one morning, about $400 in Anthropic charges, and about €200 on Google with the project suspended. Elephas cites one user with $281 on OpenAI and $168 on Anthropic overnight. These are user reports. OpenCode has confirmed no amounts.
One question remains open. As of October 19, per aifreeapi, OpenCode had not explained why its own keys were revoked, including on accounts with no linked provider.
What do the two OpenCode errors mean?
The first error, This API key has expired., means OpenCode's backend rejected your OpenCode credential. The second, Upstream request failed: Insufficient account funds, usually appears after you sign back in and requests route to the wrong billing source. They are different problems with different fixes.
| Error | HTTP / code | What it means | Fix |
|---|---|---|---|
This API key has expired. | 401, api_key_expired | Your OpenCode key is dead | Sign in again or create a new key |
Internal error: This API key has expired | shown in the TUI | Same error, wrapped by the terminal UI | Same |
Upstream request failed: Insufficient account funds | upstream error | Billed to empty Console credit, not your Go subscription | Pick an opencode-go/ model |
Upstream request failed: Invalid credential | upstream error | A stale or wrong credential is being sent | Hunt the hidden key below |
Issue #56586 shows the second one in practice. After the reporter signed in through /connect, requests returned "Insufficient account funds" until they selected an opencode-go/* model.
That issue is still open. A fix is linked in PR #56670, not merged. A bot reply said the messages come from the backend, so the wording needs backend changes.
What is the 5-minute fix?
The fix is five steps: sign in again, replace the key, clear the stale copies, revoke provider keys, and set a hard spending limit. The first two restore access. The last three stop a leaked key from costing you money.
- Sign in again. In the TUI, run
/connect, choose OpenCode (not "OpenCode Go"), and finish browser sign-in. Per aifreeapi, this issues OAuth tokens, and Dax Raad said logins "default to oauth tokens not long lived api keys." - Replace the stored key. Create a new one in the Console (service account keys start with
oc_sk_and show once). Then run:
opencode auth logout
opencode auth login
opencode auth list
For Go, opencode auth login opencode-go --method key works.
- Restart everything. Fully quit the desktop app, including the tray icon, or reload VS Code. Stop any
opencode serveyou started. - Revoke provider keys at the provider. Open OpenAI, Anthropic and Google, delete each key you ever saved in OpenCode, create new ones, and update your apps.
- Set a hard limit (covered below).
See also our guide to how JWT and token auth works if long-lived keys versus OAuth tokens is new to you.
Where is the hidden key that keeps breaking things?
An old OpenCode key can survive in several places and override your new login. If a fresh key still fails, check these in order. All come from aifreeapi's guide.
| Place | What to look for |
|---|---|
| Environment | OPENCODE_API_KEY in your shell or a project .env |
opencode.json | an apiKey under provider.opencode.options (overrides the stored login) |
auth.json | an older opencode entry in ~/.local/share/opencode/auth.json |
| Running processes | desktop app, tray, or opencode serve still holding the old key |
| Third-party clients | LiteLLM and similar keep their own copy |
The auth.json entry is the sneaky one. A community user reported that login and logout commands did not remove it. On Windows the path is %USERPROFILE%\.local\share\opencode\auth.json. Back the file up before editing it. This is a community workaround, not an official procedure.
Issue #56586 adds a related detail: the reporter's key was created automatically during an upgrade or migration, and lasted about 47 hours. You may have a key you never knowingly made.
How do you stop a leaked key from running up your AI bill?
Set a hard spending limit at each provider. Alerts only notify you after money is spent. A hard limit blocks further requests. Also revoke at the provider, because deleting a key inside OpenCode does not disable it.
Practical rules, per Elephas:
- Disable the old key at the AI provider that issued it.
- Create a new key and update every app using it.
- Set a hard spending limit. Google's monthly cap is experimental and can run over by about 10 minutes of spending.
- Review usage logs at each provider for calls you did not make, back to mid-October.
If you never got a breach email, OpenCode told users without one they were not impacted. Rotating anyway costs five minutes. For the wider habit, our post on reviewing AI-generated code covers what agents can touch, and the Claude cache math shows how fast agent usage adds up.
What should you do this week?
- Run
/connectand confirmopencode auth listshows one valid entry. - Grep for
OPENCODE_API_KEYin your shell profile and.envfiles. - Check
opencode.jsonandauth.jsonfor old keys. - Revoke and replace every provider key ever saved in the Console.
- Set hard spending limits at OpenAI, Anthropic and Google.
- Check status.opencode.ai before blaming your machine.
FAQ
Why does OpenCode say my API key expired when I set no expiry?
The message is returned by OpenCode's backend as a 401 with code api_key_expired. Reports began around October 17, 2026, the same day as the breach disclosure. OpenCode has not explained why its own keys were revoked, so treat it as revocation, not natural expiry.
Does the breach affect the open-source OpenCode CLI?
No, according to OpenCode co-founder Dax Raad, as reported by Elephas and others. The breached system was the hosted Console, which stored users' provider keys. The open-source app and command-line tool were not affected.
Is deleting my key in OpenCode enough?
No. A key saved in the Console may have been exposed, so you must revoke it at the provider that issued it. Then create a replacement and update your apps.
Who do I contact if sign-in fails?
Sign-in errors such as "Too many registration attempts. Please wait an hour" come from the hosted Console. Check status.opencode.ai, wait the full hour, then email help@anoma.ly. OpenCode handles account questions by email, per aifreeapi.
Do the five steps today, then browse the free tools on Art of Code while the new keys propagate, or see how AI is changing which coding skills survive.
Written by Adithya Guttha, Founder of Art of Code.
Sign in to like and save posts.
Keep reading
Discussion
Comments (0)
Want to join the conversation?
Sign in to commentNo comments yet. Be the first to comment!