Inject secrets and env values into config
configuration
// what it does
opencode.json supports {env:VAR} to pull a value from an environment variable and {file:path} to read it from a file, so keys stay out of the committed config. {file:~/.secrets/anthropic} and absolute or ~ paths work; relative paths resolve from the config directory.
// shell
$ { "model": "{env:OPENCODE_MODEL}" }$ { "provider": { "openai": { "options": { "apiKey": "{file:~/.secrets/openai}" } } } }// gotcha
This is opencode's own substitution, not shell expansion — $VAR will not work, only {env:VAR}. If a key resolves to empty the variable or file is missing, and opencode does not error loudly about it.