OpenCode

OpenCode on a universal Guard API key.

Model protocol

Claude, Kimi, Composer and Grok

The commands in this section read the key from the GUARD_API_KEY variable. Enter it at the hidden prompt; the variable applies only to this terminal and the client started from it.

Environment variables

bash · macOS / Linux

{
unset GUARD_API_KEY
until [ -n "${GUARD_API_KEY-}" ]; do printf "Guard API key: "; read -r -s GUARD_API_KEY || break; printf "\n"; done
export GUARD_API_KEY
}

PowerShell · Windows

do {
  $guardKey = Read-Host "Guard API key" -AsSecureString
  $env:GUARD_API_KEY = [System.Net.NetworkCredential]::new("", $guardKey).Password
} until ($env:GUARD_API_KEY)

OpenCode is configured the same way as Claude Code — via the Anthropic variables.

Environment variables

bash · macOS / Linux

export ANTHROPIC_BASE_URL="https://api.guardrelay.ai"
export ANTHROPIC_API_KEY="$GUARD_API_KEY"

PowerShell · Windows

$env:ANTHROPIC_BASE_URL = "https://api.guardrelay.ai"
$env:ANTHROPIC_API_KEY = "$env:GUARD_API_KEY"

Kimi, Composer and Grok

The ANTHROPIC_* variables point OpenCode at /v1/messages. Composer and Grok accept that surface, client tools included.

Environment variables

bash · macOS / Linux

export ANTHROPIC_BASE_URL="https://api.guardrelay.ai"
export ANTHROPIC_API_KEY="$GUARD_API_KEY"
# then pick a model in the client, e.g. cursor-grok-4.6-high or composer-2.5

PowerShell · Windows

$env:ANTHROPIC_BASE_URL = "https://api.guardrelay.ai"
$env:ANTHROPIC_API_KEY = "$env:GUARD_API_KEY"
# then pick a model in the client, e.g. cursor-grok-4.6-high or composer-2.5

For Kimi, configure an OpenAI-compatible provider in OpenCode pointing at https://api.guardrelay.ai/v1 and use one of the six Kimi IDs.

Kimi in OpenCode

The ANTHROPIC_* variables take OpenCode to the Anthropic Messages protocol. The path below goes through an OpenAI-compatible provider: it is configured with the same two values, an address and a key.

Take an OpenAI-compatible provider. Base URL https://api.guardrelay.ai/v1, exactly with /v1, header Authorization: Bearer gd-…, and one of the six ids in the model field: k3.1-pro, k3.1-pro-highspeed, k3, k3-256k, kimi-for-coding or kimi-for-coding-highspeed.

First make sure the key answers. The command below returns the model text:

bash

curl -X POST https://api.guardrelay.ai/v1/chat/completions \
  -H "Authorization: Bearer $GUARD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "k3",
    "messages": [{"role": "user", "content": "Hello!"}],
    "max_tokens": 128
  }'

GLM 5.3 in OpenCode

Install OpenCode

Follow the official OpenCode guide. Use the first block on macOS/Linux, or the second on Windows with Node.js.

bash

curl -fsSL https://opencode.ai/install | bash
opencode --version

powershell

npm install -g opencode-ai
opencode --version

Get a Guard key

Get a universal gd-… key from the direct API link in @guardapi and choose an API package. Do not put the key in a project, repository, task prompt, or screenshot. Balance and usage are available in your Guard account.

Create a separate GLM configuration

Save the example as a separate ~/.config/opencode-guard-glm/opencode.json file (Windows: %USERPROFILE%\.config\opencode-guard-glm\opencode.json). Do not replace the normal global config: OPENCODE_CONFIG attaches this file only to the GLM launch. The full model name is openai/glm-5.3.

json

{
  "$schema": "https://opencode.ai/config.json",
  "model": "openai/glm-5.3",
  "provider": {
    "openai": {
      "options": {
        "baseURL": "{env:GUARD_GLM_BASE_URL}",
        "apiKey": "{env:GUARD_GLM_API_KEY}"
      },
      "models": {
        "glm-5.3": { "name": "GLM 5.3" },
        "glm-5.3-flash": { "name": "GLM 5.3 Flash" }
      }
    }
  }
}

The configuration contains only environment references. Set the key, Base URL, and OPENCODE_CONFIG path before launch.

macOS / Linux: enter the key at the hidden prompt. The variable applies only to this terminal and the client started from it.

{
unset GUARD_GLM_API_KEY
until [ -n "${GUARD_GLM_API_KEY-}" ]; do printf "Guard API key: "; read -r -s GUARD_GLM_API_KEY || break; printf "\n"; done
export GUARD_GLM_API_KEY
export GUARD_GLM_BASE_URL="https://api.guardrelay.ai/glm/v1"
export OPENCODE_CONFIG="$HOME/.config/opencode-guard-glm/opencode.json"
opencode
}

Windows PowerShell: run these commands in the same window that starts the client. Set the key again after opening a new PowerShell window.

powershell

$guardKey = Read-Host "Guard API key" -AsSecureString
$env:GUARD_GLM_API_KEY = [System.Net.NetworkCredential]::new("", $guardKey).Password
$env:GUARD_GLM_BASE_URL = "https://api.guardrelay.ai/glm/v1"
$env:OPENCODE_CONFIG = "$HOME/.config/opencode-guard-glm/opencode.json"
opencode

Quick check and continuation

Select openai/glm-5.3 through /models in the interactive UI. For a short command and a follow-up, use:

bash

opencode run --model openai/glm-5.3 "Reply with exactly GLM_OK and remember PINE"
opencode run --continue "What word were you asked to remember?"

Models and confirmed capabilities

Model ID	When to use it
`glm-5.3`	Default model; text and coding tasks.
`glm-5.3-flash`	Fast model; at API level it accepts PNG and PDF through all three protocols, and MP4 through Chat Completions only.

Responses, local read/edit/shell tools, and --continue for the same session are confirmed.
The client itself executes file, edit, and terminal tools. This profile does not connect Z.AI tools or MCP automatically.
This version was checked with text tasks; its attachment button was not checked. Flash capability at API level does not prove that this particular UI can send a file.
The profile uses OpenAI Responses. The GLM server prompt is off by default for ordinary API access; client setup does not enable it.
Native TXT, DOCX, and XLSX are outside the confirmed GLM contract. Use PDF for documents, or PNG with glm-5.3-flash for images.

If the connection fails

Symptom	What to check
`401 invalid_api_key`	The client received the complete active `gd-…` key; the variable is set in the same process that starts the client.
`404 model_not_found`	The model ID is exactly `glm-5.3` or `glm-5.3-flash`; old GLM IDs, aliases, Turbo, and FlashX are unsupported.
`404` or incorrect path	Base URL is `https://api.guardrelay.ai/glm/v1`. The client appends `/responses`; do not add it twice.
`400 invalid_request`	The documented API format is selected; reasoning, temperature, MCP, or other unconfirmed fields were not copied from an older profile.
`402 insufficient_balance`	Check available balance and unfinished reservations in your Guard account.
The model is missing from `/models`	Check `OPENCODE_CONFIG`, `provider.openai.models`, full name `openai/glm-5.3`, and whether a project-level file overrides this model.

Gemini in OpenCode

Install OpenCode

Follow the official OpenCode guide. Use the first block on macOS/Linux, or the second on Windows with Node.js.

bash

curl -fsSL https://opencode.ai/install | bash
opencode --version

powershell

npm install -g opencode-ai
opencode --version

Get a Guard key

Create a separate Gemini configuration

Save the example as a separate ~/.config/opencode-guard-gemini/opencode.json file (Windows: %USERPROFILE%\.config\opencode-guard-gemini\opencode.json). Do not replace the normal global config: OPENCODE_CONFIG attaches this file only to the Gemini launch. The full model name is openai/gemini-4-argon.

json

{
  "$schema": "https://opencode.ai/config.json",
  "model": "openai/gemini-4-argon",
  "provider": {
    "openai": {
      "options": {
        "baseURL": "{env:GUARD_GEMINI_BASE_URL}",
        "apiKey": "{env:GUARD_GEMINI_API_KEY}"
      },
      "models": {
        "gemini-4-argon": { "name": "Gemini 4 Argon" },
        "gemini-3.8-flash": { "name": "Gemini 3.8 Flash" }
      }
    }
  }
}

The configuration contains only environment references. Set the key, Base URL, and OPENCODE_CONFIG path before launch.

macOS / Linux: enter the key at the hidden prompt. The variable applies only to this terminal and the client started from it.

{
unset GUARD_GEMINI_API_KEY
until [ -n "${GUARD_GEMINI_API_KEY-}" ]; do printf "Guard API key: "; read -r -s GUARD_GEMINI_API_KEY || break; printf "\n"; done
export GUARD_GEMINI_API_KEY
export GUARD_GEMINI_BASE_URL="https://api.guardrelay.ai/v1"
export OPENCODE_CONFIG="$HOME/.config/opencode-guard-gemini/opencode.json"
opencode
}

Windows PowerShell: run these commands in the same window that starts the client. Set the key again after opening a new PowerShell window.

powershell

$guardKey = Read-Host "Guard API key" -AsSecureString
$env:GUARD_GEMINI_API_KEY = [System.Net.NetworkCredential]::new("", $guardKey).Password
$env:GUARD_GEMINI_BASE_URL = "https://api.guardrelay.ai/v1"
$env:OPENCODE_CONFIG = "$HOME/.config/opencode-guard-gemini/opencode.json"
opencode

Quick check and continuation

Select openai/gemini-4-argon through /models in the interactive UI. For a short command and a follow-up, use:

bash

opencode run --model openai/gemini-4-argon "Reply with exactly GEMINI_OK and remember PINE"
opencode run --continue "What word were you asked to remember?"

Gemini models and capabilities

Model ID	Input and window
`gemini-4-argon`	Text, images, PDF; 1,048,576-token window, shared by input and answer.
`gemini-3.8-flash`	Text, images, PDF; 1,048,576-token window for input.

OpenCode itself executes the local read, edit, and shell tools; --continue continues the same session.
The Guard catalog takes text, images, and PDF as input and returns text. How to send a file or an image depends on the client's interface; this guide does not describe attachments.
The profile uses OpenAI Responses. The server prompt is a separate setting of the Gemini family: it applies only when the key has the entitlement and the option is on; client setup does not enable it.

If the connection fails

Symptom	What to check
`401 invalid_api_key`	The client received the complete active `gd-…` key; the variable is set in the same process that starts the client.
`404 model_not_found`	The model ID is an exact ID from the table above or the short name `gemini`; other spellings are unsupported.
`404` or incorrect path	Base URL is `https://api.guardrelay.ai/v1`. The client appends `/responses`; do not add it twice.
`400 invalid_request`	The documented API format is selected; extra settings from an older profile were not copied: reasoning, temperature, MCP, and others.
`402 insufficient_credit`	Check available balance and unfinished reservations in your Guard account.
The model is missing from `/models`	Check `OPENCODE_CONFIG`, `provider.openai.models`, full name `openai/gemini-4-argon`, and whether a project-level file overrides this model.

Muse in OpenCode

Install OpenCode

Follow the official OpenCode guide. Use the first block on macOS/Linux, or the second on Windows with Node.js.

bash

curl -fsSL https://opencode.ai/install | bash
opencode --version

powershell

npm install -g opencode-ai
opencode --version

Get a Guard key

Create a separate Muse configuration

Save the example as a separate ~/.config/opencode-guard-muse/opencode.json file (Windows: %USERPROFILE%\.config\opencode-guard-muse\opencode.json). Do not replace the normal global config: OPENCODE_CONFIG attaches this file only to the Muse launch. The full model name is openai/muse-wonder-1.0.

json

{
  "$schema": "https://opencode.ai/config.json",
  "model": "openai/muse-wonder-1.0",
  "provider": {
    "openai": {
      "options": {
        "baseURL": "{env:GUARD_MUSE_BASE_URL}",
        "apiKey": "{env:GUARD_MUSE_API_KEY}"
      },
      "models": {
        "muse-wonder-1.0": { "name": "Muse Wonder 1.0" },
        "muse-spark-1.3": { "name": "Muse Spark 1.3" },
        "muse-spark-1.2": { "name": "Muse Spark 1.2" }
      }
    }
  }
}

The configuration contains only environment references. Set the key, Base URL, and OPENCODE_CONFIG path before launch.

macOS / Linux: enter the key at the hidden prompt. The variable applies only to this terminal and the client started from it.

{
unset GUARD_MUSE_API_KEY
until [ -n "${GUARD_MUSE_API_KEY-}" ]; do printf "Guard API key: "; read -r -s GUARD_MUSE_API_KEY || break; printf "\n"; done
export GUARD_MUSE_API_KEY
export GUARD_MUSE_BASE_URL="https://api.guardrelay.ai/v1"
export OPENCODE_CONFIG="$HOME/.config/opencode-guard-muse/opencode.json"
opencode
}

Windows PowerShell: run these commands in the same window that starts the client. Set the key again after opening a new PowerShell window.

powershell

$guardKey = Read-Host "Guard API key" -AsSecureString
$env:GUARD_MUSE_API_KEY = [System.Net.NetworkCredential]::new("", $guardKey).Password
$env:GUARD_MUSE_BASE_URL = "https://api.guardrelay.ai/v1"
$env:OPENCODE_CONFIG = "$HOME/.config/opencode-guard-muse/opencode.json"
opencode

Quick check and continuation

Select openai/muse-wonder-1.0 through /models in the interactive UI. For a short command and a follow-up, use:

bash

opencode run --model openai/muse-wonder-1.0 "Reply with exactly MUSE_OK and remember PINE"
opencode run --continue "What word were you asked to remember?"

Muse models and capabilities

Model ID	Input and window
`muse-wonder-1.0`	Text, images, PDF; 1,048,576-token window.
`muse-spark-1.3`	Text, images, PDF; 1,048,576-token window.
`muse-spark-1.2`	Text, images, PDF; 1,048,576-token window.

OpenCode itself executes the local read, edit, and shell tools; --continue continues the same session.
The Guard catalog takes text, images, and PDF as input and returns text. How to send a file or an image depends on the client's interface; this guide does not describe attachments.
The profile uses OpenAI Responses. The server prompt is a separate setting of the Muse family: it applies only when the key has the entitlement and the option is on; client setup does not enable it.

If the connection fails

Symptom	What to check
`401 invalid_api_key`	The client received the complete active `gd-…` key; the variable is set in the same process that starts the client.
`404 model_not_found`	The model ID is an exact ID from the table above or the short name `muse`; other spellings are unsupported.
`404` or incorrect path	Base URL is `https://api.guardrelay.ai/v1`. The client appends `/responses`; do not add it twice.
`400 invalid_request`	The documented API format is selected; extra settings from an older profile were not copied: reasoning, temperature, MCP, and others.
`402 insufficient_credit`	Check available balance and unfinished reservations in your Guard account.
The model is missing from `/models`	Check `OPENCODE_CONFIG`, `provider.openai.models`, full name `openai/muse-wonder-1.0`, and whether a project-level file overrides this model.

Install OpenCode

Install the OpenCode terminal client using the official instructions. Run the first command on macOS or Linux. On Windows, use the second command after installing Node.js. Check opencode --version afterward.

bash

curl -fsSL https://opencode.ai/install | bash
opencode --version

powershell

npm install -g opencode-ai
opencode --version

Get a Guard key

Open @guardapi, choose a package, and save the gd-… key. One key covers all eight families; the Codex profile uses https://api.guardrelay.ai/codex/v1. See Keys and URL.

Add a provider and model

Set GUARD_API_KEY in the environment before launch, then run opencode in your project folder. The verified profile reads the key through {env:GUARD_API_KEY} and does not require a separate /connect.
Open the global file ~/.config/opencode/opencode.json or opencode.jsonc (Windows: %USERPROFILE%\.config\opencode\opencode.json). In an existing file, add only guard inside the providers object and keep all other settings and providers.
For native Responses, set package: @opencode/ai/providers/openai/responses and settings.baseURL: https://api.guardrelay.ai/codex/v1. If your project has its own opencode.json(c), check that it does not override the same provider ID.
Save the file. In OpenCode, enter /models and select guard/gpt-6-astra. The other six exact IDs are in Models.

jsonc

{
  "$schema": "https://opencode.ai/config.json",
  "model": "guard/gpt-6-astra",
  "providers": {
    "guard": {
      "name": "GUARD API · Codex",
      "env": ["GUARD_API_KEY"],
      "package": "@opencode/ai/providers/openai/responses",
      "settings": {
        "baseURL": "https://api.guardrelay.ai/codex/v1",
        "apiKey": "{env:GUARD_API_KEY}"
      },
      "models": {
        "gpt-6-astra": {"modelID": "gpt-6-astra", "name": "GPT-6 Astra"}
      }
    }
  }
}

In OpenCode V1, limit.context and limit.output must be set together. Treat limit.output as a client budget: Guard accepts and preserves the emitted max_output_tokens, but managed Codex does not guarantee hard truncation. Automatic full-window metadata for this custom provider is unconfirmed; the client indicator is not a server limit.

The latest saved Guard native catalog declares these maximum-window values for client-side budgeting. They are not verified hard input caps; the client may compact history sooner. In the Guard connection, all seven models accept and preserve max_output_tokens (Responses), max_completion_tokens (Chat), and max_tokens (Messages) as advisory, without guaranteeing a hard managed Codex output limit; billing follows actual tokens and the key's money rules.

Model ID	Context value for client setup
`gpt-6-astra`	`872000`
`gpt-6.1-sol`	`872000`
`gpt-6-sol`	`872000`
`gpt-6-luna`	`872000`
`gpt-5.6-sol`	`872000`
`gpt-5.6-terra`	`872000`
`gpt-5.6-luna`	`872000`

Send the first request and continue

After selecting the model, type Reply with exactly OK in OpenCode. For a one-off request without the interactive UI, run the command below in your project folder. Your next message in the same session continues the conversation. After closing the terminal, return with opencode --continue or opencode run --continue "Continue the previous task".

bash

opencode run --model guard/gpt-6-astra "Reply with exactly OK"

If connection fails

Symptom	Check
No model in `/models`	`providers.guard` exists, `model` is `guard/gpt-6-astra`, and the file is in the stated location with valid JSON/JSONC syntax.
`401` or key rejection	The OpenCode process sees `GUARD_API_KEY`, and `settings.apiKey` is `{env:GUARD_API_KEY}`.
`404` or wrong path	Base URL ends exactly in `/codex/v1`, with no second `/v1`; the model ID matches Models.
`402`	Check the key balance and limits in your Guard account.

OpenCode

Claude, Kimi, Composer and Grok

Kimi, Composer and Grok

Kimi in OpenCode

GLM 5.3 in OpenCode

Install OpenCode

Get a Guard key

Create a separate GLM configuration

Quick check and continuation

Models and confirmed capabilities

If the connection fails

Gemini in OpenCode

Install OpenCode

Get a Guard key

Create a separate Gemini configuration

Quick check and continuation

Gemini models and capabilities

If the connection fails

Muse in OpenCode

Install OpenCode

Get a Guard key

Create a separate Muse configuration

Quick check and continuation

Muse models and capabilities

If the connection fails

Install OpenCode

Get a Guard key

Add a provider and model

Send the first request and continue

If connection fails

Sections

On this page