OpenCode Kiro Auth Plugin

Every effort-capable Claude model has a -thinking companion. You do not need to manually configure reasoning; simply pick a -thinking model and cycle its variants to change the reasoning depth.

Important: If you override provider.kiro.models in your own configuration, you must manually include these two fields in any -thinking model you define, otherwise reasoning will not render:

{
  "reasoning": true,
  "interleaved": { "field": "reasoning_content" }
}

OpenCode maps thinkingConfig.thinkingBudget to Kiro's native effort levels using the following scale:

You can authenticate using two primary methods:

1. Kiro CLI (Recommended)

If you have kiro-cli installed, perform a login in your terminal:

kiro-cli login

Upon starting OpenCode, the plugin will automatically detect the Kiro CLI database, bootstrap a placeholder, and synchronize your active session.

2. Direct Authentication

If you prefer not to use the CLI, run the following command in OpenCode:

opencode auth login

• Select Other and type kiro.
• For AWS Builder ID: Leave the IAM Identity Center Start URL and region blank.
• For IAM Identity Center (SSO): Enter your company's Start URL and region (sso_region).

Note: Use opencode auth login instead of the TUI /connect flow if you need to provide provider-specific OAuth values like the Start URL.

To use the Kiro provider in OpenCode, add the plugin to your opencode.json or opencode.jsonc configuration file. Once installed, the plugin automatically registers the kiro provider and all available Kiro models, including -thinking variants for reasoning. You can select a model by running /models within OpenCode.

{
  "plugin": ["@zhafron/opencode-kiro-auth"]
}

Global plugin behavior (auth sync, account rotation, retries, and effort mapping) is managed in ~/.config/opencode/kiro.json (Linux/macOS) or %APPDATA%\opencode\kiro.json (Windows).

{
  "auto_sync_kiro_cli": true,
  "account_selection_strategy": "lowest-usage",
  "default_region": "us-east-1",
  "idc_start_url": "https://your-company.awsapps.com/start",
  "idc_region": "us-east-1",
  "rate_limit_retry_delay_ms": 5000,
  "rate_limit_max_retries": 3,
  "max_request_iterations": 20,
  "request_timeout_ms": 120000,
  "token_expiry_buffer_ms": 120000,
  "usage_sync_max_retries": 3,
  "usage_tracking_enabled": true,
  "auto_effort_mapping": true,
  "enable_log_api_request": false
}

The plugin uses Effort levels to define the reasoning depth for Kiro models. Effort levels are ordered from lowest to highest:

• low (Budget: 16384)
• medium (Budget: 32768)
• high (Budget: 65536)
• xhigh (Budget: 98304)
• max (Budget: 128000)

Note that xhigh is only supported by specific high-end models (e.g., claude-opus-4.7, claude-opus-4.8, claude-opus-5, claude-sonnet-5, claude-sonnet-5-1m). If xhigh is requested on a model that does not support it, the plugin will automatically clamp the request to max.

import type { Effort } from './config/schema'

// Available Effort levels:
// 'low' | 'medium' | 'high' | 'xhigh' | 'max'

Error: Status: 403 (AccessDeniedException)

If using IAM Identity Center, the API requires a profile ARN. The plugin attempts to read this from the kiro-cli database. Fix: Run kiro-cli profile and select a profile (e.g., QDevProfile-us-east-1), then retry login.

Error: No accounts

This occurs if ~/.config/opencode/kiro.db is empty. Fix:

1. Ensure kiro-cli login succeeds.
2. Ensure auto_sync_kiro_cli is set to true in kiro.json.
3. Restart OpenCode to trigger a sync.

Kiro CLI (Google/GitHub OAuth) sync issues

If you used Google/GitHub OAuth via kiro-cli, the plugin needs a minimal kiro entry in OpenCode's auth.json to trigger the loader. Fix: Restart OpenCode after your kiro-cli login. The plugin will automatically create the placeholder and sync your tokens.

Use createKiroPlugin to instantiate the OpenCode Kiro Auth plugin. This is the primary entrypoint for integrating Kiro authentication into your application.

import { createKiroPlugin } from '@zhafron/opencode-kiro-auth';

const plugin = createKiroPlugin(config);

Use createSdkClient to instantiate a CodeWhispererStreamingClient configured for Kiro. The function manages an internal cache to reuse clients with the same credentials, region, and effort level.

When an effort is provided, the client automatically injects additionalModelRequestFields into the request body to control the model's thinking effort. This is useful for managing the computational intensity of the model's responses.

import { createSdkClient } from '@zhafron/opencode-kiro-auth/src/plugin/sdk-client';

const client = createSdkClient(
  {
    email: 'user@example.com',
    access: 'YOUR_ACCESS_TOKEN'
  },
  'us-east-1',
  'high' // Optional Effort level
);

The plugin operates within specific AWS regions. If a region is invalid or undefined, it defaults to us-east-1.

Key utilities for region management:

• isValidRegion(region): Validates if a string is a supported KiroRegion.
• normalizeRegion(region): Returns the provided region if valid, otherwise returns us-east-1.
• extractRegionFromArn(arn): Parses an AWS ARN to extract the region component.
• buildUrl(template, region): Replaces the {{region}} placeholder in a URL template with a specific KiroRegion.

import { normalizeRegion, buildUrl } from 'src/constants';

const region = normalizeRegion('us-west-2'); // 'us-west-2'
const url = buildUrl('https://q.{{region}}.amazonaws.com/getUsageLimits', region);
// Result: 'https://q.us-west-2.amazonaws.com/getUsageLimits'

Use kiroWebSearch to call Kiro's server-side web_search MCP tool. This function handles authentication (including automatic token refreshing), query trimming, and result parsing.

Requirements & Limitations:

• Account Type: Requires a Kiro Pro account (the account must have a profileArn).
• Query Length: The query is automatically capped at 200 characters.
• Timeout: Requests have a hard timeout of 30,000ms.

Returns an array of WebSearchResult objects.

import { kiroWebSearch } from './path/to/web-search';

// Assuming accountManager is already initialized
const results = await kiroWebSearch(accountManager, 'What is the current weather in Tokyo?');
console.log(results);