Skip to content

fix: Invalidate oauth credentials when oauth provider says so#14007

Merged
rekram1-node merged 1 commit intoanomalyco:devfrom
GreenStage:egomes/refresh-token-invalidate
Feb 17, 2026
Merged

fix: Invalidate oauth credentials when oauth provider says so#14007
rekram1-node merged 1 commit intoanomalyco:devfrom
GreenStage:egomes/refresh-token-invalidate

Conversation

@GreenStage
Copy link
Contributor

What does this PR do?

This PR makes opencode's oauth handling respect the oauth provider invalidation callback. This fixes #13998 , and potentially other issues arising from the code persisting invalid credentials, even after the oauth provider deemed them as invalid.

How did you verify your code works?

  • Logged in and made my MCP server return a refresh token valid for 30m, access tokens valid for 15m.
  • After 16 minutes, ran opencode mcp auth and it refreshed my access token automatically (no regression)
  • After 35 minutes, ran opencode mcp auth and it kicked my to the login page
image

@rekram1-node rekram1-node merged commit fb79dd7 into anomalyco:dev Feb 17, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Opencode not handling expired refresh_tokens

2 participants

Comments