Do I need to edit an OpenCode configuration file?

Yes. This guide adds opencode.json to deny commands and edits during the first inspection. DigitalOcean authentication still uses /connect.

What should I close and restart after I set it up?

After the read-only test, exit OpenCode using your terminal's normal interruption control (Ctrl+C in most terminals). Start T3 Code from a terminal where opencode --version works. If models do not appear, verify /models in OpenCode, then select the environment in T3 Code Settings and use Refresh provider status.

Should I use OAuth or a Model Access Key?

Use Login with DigitalOcean (OAuth) for your first setup. OpenCode recommends it and it can discover DigitalOcean Inference Routers. Use Paste Model Access Key only when you already have a scoped key from your team or prefer that credential model.

What should I record after the first read-only request works?

Record the selected model, the disposable project used, and that the request returned a summary without an edit, command approval, or another credential prompt. That gives you a repeatable baseline if provider discovery or permissions later change.

← All guides

AI Development

Set Up OpenCode with Serverless AI Inference

August 24, 2026

Connect OpenCode to serverless inference, prove a read-only request in a disposable project, then use the same connection in T3 Code.

Jump to article ↓

Before you start

OpenCode is the coding agent. T3 Code is an optional interface that uses the OpenCode provider; DigitalOcean supplies the hosted models in this guide. You can stop after the OpenCode test in step 3. This guide does not configure local models.

Create a disposable folder named opencode-first-run. In your editor, create index.html containing exactly <h1>Hello, OpenCode</h1>, then README.md containing exactly: A static greeting page. Open index.html in a browser. These two files are enough; do not copy a private project. In the commands below, replace the example project path with this folder’s actual path.

OpenCode can read the project you open. Use the disposable project listed below for the first request. Sign in to DigitalOcean inside OpenCode, and never store credentials in Git or project files.

A DigitalOcean account that can use Serverless Inference
A disposable local project folder with no secrets or sensitive data
Node.js 22.16 or newer on the 22.x line, 23.11 or newer on the 23.x line, or 24.10 or newer
Any terminal available on your operating system
A small prepaid balance and a spending boundary you understand; inference is billed by input and output tokens

1. Confirm Node.js, then install OpenCode

Open your usual terminal. Run each command separately and read its result before moving on. T3 Code requires Node.js 22.16 or newer on the 22.x line, 23.11 or newer on the 23.x line, or 24.10 or newer. If the version is outside those ranges, install a supported Node.js release and open a new terminal.

Install OpenCode globally, then verify that this terminal can run it. T3 Code needs OpenCode 1.14.19 or newer. These npm commands work the same way in PowerShell, macOS Terminal, and common Linux shells.

node --version

npm install -g opencode-ai

opencode --version

2. Connect a serverless inference provider inside OpenCode

Before starting OpenCode, save the opencode.json below in the disposable folder. It allows file reading and search, but denies edits, shell commands, other tools, and access outside the folder. Keep the Build agent selected. A prompt alone does not set these permissions.

At the OpenCode prompt, enter /connect. Choose DigitalOcean, then choose Login with DigitalOcean. Your browser opens for approval; sign in, approve the connection, then return to OpenCode.

OAuth is the recommended first setup because it discovers DigitalOcean Inference Routers, but OpenCode uses your DigitalOcean API token for inference. Use it for an interactive personal setup only. If your team has given you a scoped Model Access Key, choose Paste Model Access Key and enter it only at OpenCode's credential prompt. A pasted key does not discover routers. Never put either credential in Git, a screenshot, or a project file.

{
  "$schema": "https://opencode.ai/config.json",
  "default_agent": "build",
  "permission": {
    "*": "deny",
    "read": {
      "*": "allow",
      "*.env": "deny",
      "*.env.*": "deny"
    },
    "glob": "allow",
    "grep": "allow",
    "edit": "deny",
    "bash": "deny",
    "external_directory": "deny"
  },
  "agent": {
    "build": {
      "permission": {
        "*": "deny",
        "read": {
          "*": "allow",
          "*.env": "deny",
          "*.env.*": "deny"
        },
        "glob": "allow",
        "grep": "allow",
        "edit": "deny",
        "bash": "deny",
        "external_directory": "deny"
      }
    }
  }
}

Open the project directoryLocal terminal
Replace every highlighted value before running this command.
```
Set-Location -LiteralPath "C:\path\to\your-project"
```
Start OpenCode
```
opencode
```
OpenCode opens in the disposable project before you enter application commands.

/connect

3. Pick a model and run a safe first test

Check the restrictions with the probe below first. The agent must refuse the write and command, or report that those tools are disabled. In your editor, confirm permission-probe.txt does not exist and the two original files are unchanged. If either action succeeds, stop the session and correct the configuration before the inspection.

For these files, expect a static greeting page, index.html as the entry point, and an improvement such as adding a page title. Wording may vary. Compare both files with their original contents: neither should change. This is the expected acceptance criterion, not a recorded model response.

In OpenCode, enter /models and choose a DigitalOcean model. A router appears as router:<name>. Choose a router only if you created one in DigitalOcean; otherwise select a listed model.

When the read-only test succeeds, exit OpenCode with its normal exit control, Ctrl+C in most terminals.

/models

Try to create permission-probe.txt containing test, then try to run echo permission-probe. Report which actions are unavailable. Do not use another tool to bypass a denied action.

Inspect this disposable repository. Do not edit, create, delete, run commands, read .env files, or access anything outside this folder. Tell me:
1. what this project does,
2. where the main application starts, and
3. one low-risk improvement I could make.

4. Optional: start T3 Code in Supervised mode

Run T3 Code from a terminal where the earlier opencode --version check succeeded. It starts a local server and opens its web interface. In T3 Code, open Settings and enable the OpenCode provider; it is off by default.

Create a session in the disposable project, choose OpenCode as the provider, select the DigitalOcean model you verified, and set the session to Supervised, not Full access. Reject every command or edit approval during the first inspection. You do not need to authenticate with DigitalOcean again in T3 Code.

npx t3@latest

Check before continuing: T3 Code opens and reports the OpenCode provider as available.

5. Make your first change without giving the agent too much freedom

To permit your first edit, close the session. In opencode.json, change edit from deny to ask in both permission and agent.build.permission, leaving the other denials intact. Restart OpenCode and verify that editing requests approval. You can complete this step in OpenCode alone; T3 Code remains optional.

Keep the session in Supervised mode. Ask for a plan, read it, then approve only one small, reviewable file change. A good first task changes one file and does not run commands, install packages, or touch configuration.

After the agent finishes, inspect its file changes before you run the app or commit anything. Keep an eye on your DigitalOcean prepaid balance as well: Serverless Inference is billed by input and output tokens, and requests stop when the balance reaches zero.

Before editing, show me a short plan. Change only the smallest file needed to add a short greeting to the homepage. Do not run commands, install packages, change configuration, or touch unrelated files. Stop and tell me what changed when you are done.

If it does not work, fix the right thing

If opencode --version fails or reports an older version, install or update OpenCode, open a new terminal, and rerun the check. If DigitalOcean is absent from /connect, update OpenCode with npm install -g opencode-ai and restart it.

If DigitalOcean works in OpenCode but its model is missing in T3 Code, confirm the model remains visible through /models in OpenCode. Then in T3 Code Settings, select the environment and use Refresh provider status. Update T3 Code before changing settings, since provider discovery can change between releases.

If T3 Code cannot find OpenCode, start it from the same terminal where opencode --version works. Wait for any OpenCode helper to become idle, then refresh provider status. Set Binary path only if detection still fails, using the executable path from the command below.

If a request fails after setup, confirm your DigitalOcean account can use Serverless Inference and has a positive prepaid balance, then run /connect again. Do not create another credential or edit configuration files before those checks.

/undo can restore an unwanted OpenCode file edit from its snapshot. It cannot reverse shell commands, external side effects, or changes outside the snapshot.

(Get-Command opencode).Source

Check your result

Expected result: The agent returns a small inspection summary without asking for another credential, approval, or a file change.
Stop if: Stop if a model is absent, authentication repeats, or the first inspection asks to read secrets, run a command, or change the repository.
Next step: Review the summary, choose one small edit yourself, and run the original check again.