Skip to content

fix: Invalidate oauth credentials when oauth provider says so - #14007

Merged
rekram1-node merged 1 commit into
anomalyco:devfrom
GreenStage:egomes/refresh-token-invalidate
Feb 17, 2026
Merged

rekram1-node merged 1 commit into
anomalyco:devfrom
GreenStage:egomes/refresh-token-invalidate

Conversation

@GreenStage

Copy link
Copy Markdown
Contributor

What does this PR do?

This PR makes opencode's oauth handling respect the oauth provider invalidation callback. This fixes #13998 , and potentially other issues arising from the code persisting invalid credentials, even after the oauth provider deemed them as invalid.

How did you verify your code works?

  • Logged in and made my MCP server return a refresh token valid for 30m, access tokens valid for 15m.
  • After 16 minutes, ran opencode mcp auth and it refreshed my access token automatically (no regression)
  • After 35 minutes, ran opencode mcp auth and it kicked my to the login page
image

@rekram1-node
rekram1-node merged commit fb79dd7 into anomalyco:dev Feb 17, 2026
9 checks passed
Rwanbt pushed a commit to Rwanbt/unifia that referenced this pull request May 5, 2026
AIALRA-0 pushed a commit to AIALRA-0/opencode-turn-engine that referenced this pull request Jun 10, 2026
Rwanbt pushed a commit to Rwanbt/unifia that referenced this pull request Jun 14, 2026
MarsQiu007 referenced this pull request in MarsQiu007/openNovel Jul 31, 2026
meSingh pushed a commit to meSingh/opencode that referenced this pull request Sep 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Opencode not handling expired refresh_tokens

2 participants