You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
GitHub Copilot preview models rejected — auth plugin sends raw OAuth token instead of exchanging for Copilot session token #19338
Preview models on the GitHub Copilot API (e.g. claude-opus-4.6-fast) fail with 400 model_not_supported when used through opencode, despite being valid and available on the Copilot API.
There are three interconnected issues in the copilot auth plugin (src/plugin/copilot.ts):
1. Wrong OAuth App for device flow
The plugin uses OAuth App client ID Ov23li8tweQw6odWQebz, which produces gho_ tokens. The Copilot session token exchange endpoint (/copilot_internal/v2/token) only accepts GitHub App user tokens (ghu_). The correct client ID is Iv1.b507a08c87ecfe98 (the GitHub Copilot CLI GitHub App), which other Copilot integrations use.
2. No session token exchange
The raw GitHub token is sent directly as the Authorization: Bearer header (line 126). This works for GA models but the Copilot API rejects preview models unless a proper Copilot session token (tid=...) is used, obtained via a GET to /copilot_internal/v2/token with Authorization: token <github_token>.
3. Missing Copilot integration headers on API requests
The fetch wrapper doesn't include Editor-Version, Editor-Plugin-Version, or Copilot-Integration-Id headers on API requests. The session token is scoped to the integration specified during the exchange, and the API returns 403 Forbidden: token not authorized for this integration if these headers are missing or mismatched.
Evidence
Tested by hitting the Copilot API endpoint (POST /chat/completions) with different token and header combinations:
Token type
Headers
claude-opus-4.6 (GA)
claude-opus-4.6-fast (preview)
Raw gho_ (OAuth App)
No integration headers
✅ 200
❌ 400 model_not_supported
Raw ghu_ (GitHub App)
No integration headers
✅ 200
❌ 400 model_not_supported
Session token tid=...
With integration headers
✅ 200
✅ 200
Session token tid=...
No integration headers
❌ 403 token not authorized
❌ 403 token not authorized
The token exchange endpoint itself:
Token type
Auth scheme
Result
gho_ (OAuth App)
Bearer or token
❌ 404
ghu_ (GitHub App)
token
✅ 200
Steps to reproduce
Log in to GitHub Copilot in opencode via the device flow
This issue might be a duplicate of existing issues. Please check:
[FEATURE]: Support Github Copilot Token flow #12258: Feature request specifically about supporting GitHub Copilot token flow authentication (the same token exchange mechanism this bug report identifies as missing)
Incorrect, we have our own oauth app and we are required to use it.
If that's the only one Anomaly has, it does not work for exchanging ghu_ tokens, so what this PR is trying to achieve doesn't sound possible with the Anomaly Client ID and this can probably be closed.
Activity
github-actions commentedon Mar 26, 2026
This issue might be a duplicate of existing issues. Please check:
rekram1-node commentedon Apr 9, 2026
Incorrect, we have our own oauth app and we are required to use it.
ben-vargas commentedon Apr 9, 2026
If that's the only one Anomaly has, it does not work for exchanging
ghu_tokens, so what this PR is trying to achieve doesn't sound possible with the Anomaly Client ID and this can probably be closed.