bug(v2): SAP AI Core unusable with valid saved credentials — apiKey/serviceKey mismatch blocks authentication #56126

Activity

1. opencode-agent commented on Oct 16, 2026

   

   opencode-agentBot

   on Oct 16, 2026 – with OpenCode Agent

   Contributor

   More actions

   Thanks for the detailed report. I reproduced this on v2.0.31, which is currently the latest release.

   What I did:

   • Started opencode serve with no AICORE_SERVICE_KEY or VCAP_SERVICES set.
   • Saved a service key through POST /api/integration/sap-ai-core/connect/key, which returned 204. The key pointed at a local mock of the SAP endpoints.
   • Ran opencode run -m sap-ai-core/gpt-4.1-mini "say OK". It failed with SAP AI Core authentication failed: Could not find service credentials for AI Core…, and the mock received no requests, so the saved key was never used.
   • With the same key exported as AICORE_SERVICE_KEY, the SDK did request a token from the mock.

   This matches the mismatch you describe: the resolver passes the saved key as apiKey, but the SAP hook reads only serviceKey or the env var. The hook is still the same on the latest dev (582c974). Running dev from source fails earlier with the init crash from #54791, so I could only confirm this bug on the release. The script below reproduces it.

   For now, exporting the key as AICORE_SERVICE_KEY gets past authentication.

   Related:

   • bug(v2): SAP AI Core initialization fails  #54791: source-only SAP AI Core initialization crash
   • bug: AI SDK V2 providers silently lose usage and disable auto-compaction #50338: AI SDK V2 compatibility problems (possibly the stepFinish failure you hit after authentication)
   • [BUG]: amazon-bedrock and sap-ai-core write stored API keys into process.env, leaking them to every child process #46745: the SAP hook writes stored keys into process.env
   • bug(provider): credentials set via CLI//connect are not applied to a running server (SAP AI Core, GitHub Copilot), and SAP multi-line keys are stored truncated #46354: v1 credential and truncation issues

   Reproduction script (repro.sh)

   #!/usr/bin/env bash
   # Repro for #56126: SAP AI Core key saved via /connect never reaches the SAP SDK.
   # Usage: repro.sh            -> uses `opencode` from PATH
   #        OC_DEV=/path/to/repo repro.sh -> runs from source checkout
   set -u
   cd "$(dirname "$0")"
   OC=(opencode)
   [ -n "${OC_DEV:-}" ] && OC=(bun --conditions=browser --preload=$OC_DEV/packages/tui/node_modules/@opentui/solid/scripts/preload.js $OC_DEV/packages/cli/src/index.ts)
   export HOME=$(mktemp -d) XDG_CONFIG_HOME= XDG_DATA_HOME= XDG_STATE_HOME= XDG_CACHE_HOME=
   unset AICORE_SERVICE_KEY VCAP_SERVICES
   # CONTROL=1: also export the same key as AICORE_SERVICE_KEY; the mock then receives the SDK's token request
   [ -n "${CONTROL:-}" ] && export AICORE_SERVICE_KEY='{"clientid":"cid","clientsecret":"sec","url":"http://127.0.0.1:9999","serviceurls":{"AI_API_URL":"http://127.0.0.1:9999"},"identityzone":"x","identityzoneid":"x","appname":"x"}'
   export OPENCODE_PASSWORD=pw
   mkdir -p $HOME/proj && cd $HOME/proj && git init -q
   bun "$OLDPWD/mock.ts" > $HOME/mock.log 2>&1 & MOCK=$!
   "${OC[@]}" serve --port 4199 --hostname 127.0.0.1 --print-logs > $HOME/serve.log 2>&1 & SRV=$!
   for i in $(seq 60); do curl -s -o /dev/null http://127.0.0.1:4199/ && break; sleep 1; done
   for i in $(seq 60); do curl -s -u opencode:pw http://127.0.0.1:4199/api/integration | grep -q sap-ai-core && break; sleep 1; done
   KEY='{"clientid":"cid","clientsecret":"sec","url":"http://127.0.0.1:9999","serviceurls":{"AI_API_URL":"http://127.0.0.1:9999"},"identityzone":"x","identityzoneid":"x","appname":"x"}'
   echo "== save key via connect API"
   curl -s -u opencode:pw -w ' HTTP %{http_code}\n' -X POST http://127.0.0.1:4199/api/integration/sap-ai-core/connect/key \
     -H 'content-type: application/json' -d "$(jq -n --arg k "$KEY" '{key:$k}')"
   echo "== run prompt"
   timeout 120 "${OC[@]}" run --server http://127.0.0.1:4199 -m sap-ai-core/gpt-4.1-mini "say OK" 2>&1 | tail -20
   echo "== mock requests (saved key used => oauth/token request appears)"; cat $HOME/mock.log
   echo "== server log matches"; grep -iE "service credentials|AICORE|sap" $HOME/serve.log | tail -10
   kill $SRV $MOCK 2>/dev/null

   Run it: bash repro.sh
2. opencode-agent

   added

   reproduced

   on Oct 16, 2026