Skip to main content
OpenCode is a terminal-based AI coding agent. Point it at Consus Gateway and every request — chat, tool calls, file edits, attachments — routes through government-authorized cloud environments. Nothing transits OpenCode’s servers; the client talks to the gateway directly. Verified against OpenCode 1.18.

1. Set Your API Key

Add your Consus Gateway API key as an environment variable:
Add this to your ~/.zshrc or ~/.bashrc to persist it.

2. Configure OpenCode

OpenCode reads a global config from ~/.config/opencode/opencode.json (or opencode.jsonc) and merges in a project-level opencode.json from the repo root if one exists. Put the Consus provider in the global file so it works in every project. The config below is generated from the gateway’s model catalog, so context windows, output limits, and pricing match what the gateway enforces and bills.
What each top-level setting does:
  • model / small_model: the default model for sessions and the cheaper model OpenCode uses for titles and summaries. Change to any model from the list.
  • enabled_providers: ["consus"]: only the gateway is loaded, even if other provider credentials exist on the machine. No request can fall through to a commercial endpoint.
  • share: "disabled": turns off OpenCode’s session-sharing links, which would upload transcripts to opencode.ai.

3. Select the Model

Launch OpenCode and use the /models command to verify Consus Gateway models appear. Select one and start coding.
Streaming, tool use (file reads, writes, shell commands), multi-turn conversations, and image input all work out of the box.

Model IDs and Compliance Levels

Model IDs take the form model:level, where the level is the compliance ceiling you need: fedramp-high, il2, il4, il5, with +itar for export-controlled workloads. The config lists each model at its highest available ceiling; a lower level on the same model resolves to the same provider (for example gemini-3-5-flash:fedramp-high works as well as :il4). Your organization’s model policy still applies — a model outside your ceiling returns a policy error rather than silently routing elsewhere.

Reasoning Effort

Models flagged reasoning: true expose OpenCode’s effort selector (the medium indicator in the status bar). The gateway maps the requested effort onto each provider’s native thinking control and clamps it to the model’s supported range, so high on a model that tops out at medium is downgraded rather than rejected.

Image & PDF Input

Claude and Gemini models support images and PDF documents. The config above already includes the required fields:
  • attachment: true: enables file/image attachments in OpenCode’s UI
  • modalities.input: tells OpenCode which input types the model accepts
Without these fields OpenCode rejects attachments client-side before they reach the gateway. Paste a screenshot (Ctrl+V / Cmd+V) or attach a PDF using the attachment button. Images and files must be under 3.5 MB each; total base64 data per message (images + files combined) must be under 4.5 MB (enforced by the gateway’s request payload limit). Only application/pdf is supported for file attachments.

Spend Tracking

The cost block on each model carries the gateway’s per-million-token rates, so the spend figure in OpenCode’s sidebar is computed from the same prices you are billed at. It is a client-side estimate; the usage reported in the Consus portal is the billing record.

Enterprise Rollout

To give every engineer an identical, locked-down setup, deploy the provider block as a managed config. OpenCode reads managed files from:
  • macOS: /Library/Application Support/opencode/opencode.json
  • Linux: /etc/opencode/opencode.json
  • Windows: %ProgramData%\opencode\opencode.json
Settings in a managed file cannot be overridden by user or project config. Deploy it with your MDM (Jamf, Kandji, FleetDM) or, on macOS, as a .mobileconfig profile. The only per-person value is the API key, which each engineer gets from the Consus portal; reference it from a file the user owns:
Add further models to the managed models block as your organization enables them. With enabled_providers set, engineers cannot add another provider locally, and share: "disabled" cannot be re-enabled by the user.