Auth and OAuth

GEODE accepts ChatGPT subscription OAuth and provider PAYG API keys. The choice is expressed by a single CredentialSource. GEODE-managed subscription credentials, API keys, and plans persist in ~/.geode/auth.toml. Externally supplied environment variables and existing .env keys remain separate inputs.

Credential sources

The single SoT is the CredentialSource StrEnum in core/config/credential_source.py.

Anthropic and OpenRouter have one built-in source: api_key. Historical claude-cli/oauth values are read only to emit a migration error before binary or network dispatch.

The choice persists as [llm] anthropic_credential_source / openai_credential_source (default auto). /login source <provider> <type> writes toml only, so the choice survives a .env wipe. Each (provider, source) pair maps to one concrete adapter in the registry (core/llm/adapters/: anthropic_payg, openai_payg, codex_oauth, openrouter_payg, glm_coding_plan, glm_payg).

The /login dashboard

In-session /login manages plans and credentials on one screen (core/cli/commands/login.py). Key entry and browser logins (add, set-key, openai, anthropic, google) and source run in the thin CLI; saved keys then ask the daemon to reload. Views and plan or profile changes run in the daemon, which owns the live state. A change that could not be saved is not reported as a success.

/login add, /login anthropic, onboarding, and legacy /key share one auth persistence function. They do not copy keys into .env or global settings. A failed write preserves existing credentials; a separate process reload failure is reported independently. The model's manage_logintool accepts nonsecret inspection and selection only. Default key registration uses hidden terminal input; existing explicit/key … and /login set-key <plan> <key>forms remain supported. Retired set_api_key andmanage_auth tools have been removed.

Google Workspace

Users installing from uv or GitHub can connect with their own Google Cloud Desktop client; GEODE does not need a central OAuth app. The recommended entry point is /login google. On the first connection it explicitly asks for the client JSON path and the service bundles needed. Start from the Google Cloud console with Connect Google Workspace. For a scripted choice:

/login google --client-json ~/Downloads/client_secret.json \
  --services gmail-send,calendar-read,workspace-files

/login google services
/login google status
/login google use user@example.com
/login google --new-account --services calendar-read
/login google --services calendar-read --replace-services
/login google logout user@example.com

Authentication uses the system browser, a random 127.0.0.1 port, Authorization Code + PKCE S256, and state validation. Google does not support incremental auth for Desktop apps, so adding a service reauthorizes the union of old and new bundles for the targeted active account. GEODE refuses to save a different browser identity; connect a second identity with --new-account. To narrow a grant, provide the complete bundle set to keep together with --replace-services. gmail-read is a Restricted scope and is excluded from the recommended set. Drive, Docs, and Sheets use the non-sensitive drive.file scope, limiting GEODE to files it creates or that are individually granted to the app.

Because Workspace read results may be sent to the selected LLM provider, every read invocation is immediately preceded by a personal-data disclosure and affirmative consent. It cannot be always-allowed and fails closed in headless and sub-agent sessions. Gmail sends and Drive/Docs/Sheets/Tasks/Calendar mutations use the same non-cacheable per-invocation gate; HITL 0 and skip-permissions cannot bypass it. The full schema and Hermes comparison are in the architecture record docs/architecture/google-workspace-oauth.md.

ChatGPT credential import

The default path is a credential issued by /login openaiand stored in ~/.geode/auth.toml. GEODE can also read an existing ~/.codex/auth.json, but that is credential import only: Codex CLI is never spawned for inference.

PAYG keys

Interactive registration writes auth.toml with mode 0600./login set-key <plan-id> updates a registered plan through hidden input. Automation and external secret managers may still supply environment variables. Existing environment files are neither deleted nor migrated automatically.

# ~/.geode/.env
ANTHROPIC_API_KEY=sk-ant-...
OPENAI_API_KEY=sk-proj-...
OPENROUTER_API_KEY=sk-or-v1-...
ZAI_API_KEY={id}.{secret}

GLM supports the PAYG API-key route. The Coding Plan policy checked on 2026-09-24 restricts use to supported tools; GEODE admission is unestablished. Existing subscription profiles remain readable, execution is blocked, and billing never switches to PAYG automatically.

Failure modes

Next

• Connect Google Workspace. Cloud project and Desktop OAuth client setup.
• OAuth token rotation. The runtime behavior of refresh and cooldown.
• Configure providers. First-time credential setup.
• Configuration basics. The secrets layer and the resolution ladder.