![](\"https:\/\/demensdeum.com\/blog\/wp-content\/uploads\/2026\/10\/aibank.jpg\"\/)
<\/p>\nOpenCode is an open programming agent that works directly in the terminal: reads project files, edits code, runs commands and tests, searches the repository and works with git. Its strength is that it is not tied to one model provider and can connect dozens of providers.<\/p>\n
<\/p>\n
GigaChat is a large language model from Sber. It is not in the ready list of OpenCode providers, but this is not a problem: OpenCode connects arbitrary providers through Vercel AI SDK packages. For GigaChat there is a package gigachat-ai-sdk-provider<\/b>, which takes care of OAuth authorization and updating the access token. A separate nuance is the Ministry of Digital Development certificates: without them, Node does not trust GigaChat servers, and requests fail with a certificate verification error.<\/p>\n
In this post I will describe how to get a key, install certificates and connect GigaChat to OpenCode.<\/p>\n
To work you need three things:<\/p>\n
The key is created in your GigaChat Studio personal account. Go to developers.sber.ru\/studio, log in and create a project in the GigaChat API<\/b> section. In the project settings there is a block with authorization data: the line that is copied from there is a ready-made authorization key in base64. It is this that is substituted into the environment variable, and not the client-secret pair separately.<\/p>\n
Together with the key, scope<\/b> is specified – the access area:<\/p>\n The displayed key value should be saved immediately: it will not be shown again later, and if necessary, a new one will have to be issued.<\/p>\n It is important to understand what this line is. The authorization key is not a separate secret, but a pair of client_id:client_secret<\/b> already encoded in base64. The gigachat-js library substitutes this header into the OAuth request:<\/p>\n In response, a JWE access token comes with a lifetime of about half an hour, and then the library updates it automatically. The package itself checks that the value is similar to base64 and warns if the variable accidentally contains a \u201craw\u201d client secret. Therefore, it is necessary to transfer the ready-made base64 string from the account to the config and environment variable, and not the client_id and client_secret pair separately.<\/p>\n GigaChat API uses certificates from the NCA Ministry of Digital Development. The standard trusted roots store does not have them, so when trying to get an access token, the request fails with an error like:<\/p>\n Certificates can be installed at the operating system level – then they will be trusted by the browser and system utilities. But OpenCode runs on Node and Bun, so it\u2019s safer and easier to specify the certificate file directly in the NODE_EXTRA_CA_CERTS<\/b> variable. Download the root and issuer certificates and put them into one PEM file:<\/p>\n The file can be placed in a convenient location and its full path can be specified when starting the agent.<\/p>\n There’s a catch here. Downloaded files use CRLF line breaks, and the root certificate does not have a trailing line feed. Therefore, a regular cat concatenates the end of the first certificate and the beginning of the second into one line:<\/p>\n LibreSSL – and the system openssl on macOS, let me remind you, is exactly LibreSSL – does not accept such a file and responds with an error:<\/p>\n This means that cat alone is not enough. Each certificate must first be run through openssl: it will recode it into canonical PEM with LF line feeds and a final line feed, and only then merged:<\/p>\n You can check that the file is being read like this:<\/p>\n If the certificates are taken from another source and come in DER or PKCS#7 format, they can also be recoded into PEM:<\/p>\n The provider is described in the opencode.jsonc<\/b> configuration file. OpenCode itself will download and connect the npm package specified in the npm<\/b> field, find the createGigaChat<\/b> factory in it and pass the options to it. It is enough to list the models by their identifiers from the API.<\/p>\n The file can be placed in two places:<\/p>\n Both files use the same scheme and are combined: the project file overlaps the global one only with matching keys, the remaining settings are saved. The .jsonc extension is also supported. If GigaChat is needed only for some repositories, it is more convenient to keep the provider in the project config rather than in the global one.<\/p>\n Models available with a personal key are listed here. If you have a project for an individual entrepreneur or a legal entity with access to GigaChat 3, add the necessary identifiers from the models method to the models block.<\/p>\n It is more convenient not to store the key itself in a file, but to pass it to an environment variable: the gigachat-js package reads it automatically. The scope value can also be set to a variable. All that remains is to set the path to the certificates and launch the agent:<\/p>\n This option is also good because the secret does not end up in the local auth.json storage: it lives only in the environment of the process. This is more convenient for CI and one-time launches.<\/p>\n The set of available models depends on the scope key. The personal key (GIGACHAT_API_PERS) is available to the GigaChat and GigaChat 2 family:<\/p>\n The GigaChat 3 family (GigaChat-3-Ultra, GigaChat-3-Pro, open models like GigaChat3.5-432B-A28B-Reasoning) is visible in the console catalog, but it is not available to the personal key: it requires an individual entrepreneur project or a legal entity with scope GIGACHAT_API_B2B or GIGACHAT_API_CORP and a suitable tariff. On a personal key, such a model responds with an error:<\/p>\n You can check what your key actually outputs by querying the list of models:<\/p>\n Two more points. Model IDs in the API do not match the displayed names – the light model is called as GigaChat-2<\/b>, not GigaChat-2-Lite. And the catalog in the console does not show the same thing as what is available to your key, so you should focus on the response of the models method, and not on the list with prices.<\/p>\n In the interface, the list of models is opened with the command:<\/p>\n For routine work in the repository – navigating through files, minor edits, running tests – GigaChat-2 is quite enough. For complex tasks and design, it makes sense to switch to Pro or Max.<\/p>\n Go to the project directory and launch the agent:<\/p>\n The first step is to initialize the agent:<\/p>\n OpenCode will analyze the project structure and create a file AGENTS.md<\/b> – instructions for the agent. This file is worth committing to git: it helps the agent understand the conventions and patterns adopted in the project.<\/p>\n If for some reason you don\u2019t want to use the npm provider, a local proxy gives the same result. The GigaChat team has an official gpt2giga<\/b> – FastAPI service that translates requests in OpenAI, Anthropic and Gemini format into the GigaChat API and updates the access token itself. It is raised locally on port 8090, after which a regular OpenAI-compatible provider is configured in OpenCode via the @ai-sdk\/openai-compatible<\/b> package with the base address http:\/\/localhost:8090\/v1. The downside of this path is that you also need to keep a running Python service next to OpenCode.<\/p>\n The GigaChat API itself does not have DeepSeek models: there are only the GigaChat family and models for embeddings. If you need DeepSeek in OpenCode, but through a Russian cloud gateway, the Foundation Models service from Cloud.ru is suitable. It delivers models using the OpenAI-compatible protocol, so it is connected using the standard @ai-sdk\/openai-compatible<\/b> package.<\/p>\n In the Cloud.ru Foundation Models catalog there are, for example, the following models:<\/p>\n The key is issued in the Cloud.ru console: section Users, tab Service accounts. We create a project-level service account, then in its credentials we create an API key with the Foundation Models service. The key secret is shown once and we save it.<\/p>\n The provider configuration in opencode.json looks like this:<\/p>\n We pass the key to the environment variable:<\/p>\n Ministry of Digital Development certificates are not needed here: the api.cloud.ru domain has regular TLS, unlike GigaChat. But it is worth monitoring the balance of the project. If the account is zero, authorization passes, and requests are dropped with the billing response:<\/p>\n This is not a config error, but a signal that you need to update the project in the Cloud.ru console.<\/p>\n A couple of practical points that most often get in the way when setting up for the first time:<\/p>\n https:\/\/opencode.ai\/<\/a> https:\/\/opencode.ai\/docs\/providers\/#custom-provider<\/a> OpenCode is an open programming agent that works directly in the terminal: reads project files, edits code, runs commands and tests, searches the repository and works with git. Its strength is that it is not tied to one model provider and can connect dozens of providers. GigaChat is a large language model from Sber. It […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-196","post","type-post","status-publish","format-standard","hentry","category-notes"],"translation":{"provider":"WPGlobus","version":"3.0.6","language":"en","enabled_languages":["en","ru","zh","de","ja","fr","es","pt","hi"],"languages":{"en":{"title":true,"content":true,"excerpt":false},"ru":{"title":true,"content":true,"excerpt":false},"zh":{"title":true,"content":true,"excerpt":false},"de":{"title":true,"content":true,"excerpt":false},"ja":{"title":true,"content":true,"excerpt":false},"fr":{"title":true,"content":true,"excerpt":false},"es":{"title":true,"content":true,"excerpt":false},"pt":{"title":true,"content":true,"excerpt":false},"hi":{"title":true,"content":true,"excerpt":false}}},"_links":{"self":[{"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/posts\/196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/comments?post=196"}],"version-history":[{"count":0,"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/posts\/196\/revisions"}],"wp:attachment":[{"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/media?parent=196"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/categories?post=196"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/tags?post=196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
\nAuthorization: Basic \u0432\u0430\u0448_\u043a\u043b\u044e\u0447_\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438\n<\/code><\/pre>\n<\/div>\nCertificates of the Ministry of Digital Development<\/h2>\n
\nself-signed certificate in certificate chain\n<\/code><\/pre>\n<\/div>\n\ncurl -s https:\/\/gu-st.ru\/content\/lending\/russian_trusted_root_ca_pem.crt -o russian_trusted_root_ca_pem.crt\ncurl -s https:\/\/gu-st.ru\/content\/lending\/russian_trusted_sub_ca_pem.crt -o russian_trusted_sub_ca_pem.crt\ncat russian_trusted_root_ca_pem.crt russian_trusted_sub_ca_pem.crt > russian_trusted_ca_bundle.pem\n<\/code><\/pre>\n<\/div>\n\n-----END CERTIFICATE----------BEGIN CERTIFICATE-----\n<\/code><\/pre>\n<\/div>\n\nPEM routines:CRYPTO_internal:bad end line\n<\/code><\/pre>\n<\/div>\n\nopenssl x509 -in russian_trusted_root_ca_pem.crt -out russian_trusted_root_ca.pem\nopenssl x509 -in russian_trusted_sub_ca_pem.crt -out russian_trusted_sub_ca.pem\ncat russian_trusted_root_ca.pem russian_trusted_sub_ca.pem > russian_trusted_ca_bundle.pem\n<\/code><\/pre>\n<\/div>\n\nopenssl x509 -in russian_trusted_ca_bundle.pem -noout -subject\n<\/code><\/pre>\n<\/div>\n\nopenssl x509 -in cert.crt -inform DER -outform PEM -out cert.pem\nopenssl pkcs7 -print_certs -in bundle.p7b -out cert.pem\n<\/code><\/pre>\n<\/div>\nConnect to OpenCode<\/h2>\n
\n
\n{\n \"$schema\": \"https:\/\/opencode.ai\/config.json\",\n \"provider\": {\n \"gigachat\": {\n \"npm\": \"gigachat-ai-sdk-provider\",\n \"name\": \"GigaChat\",\n \"models\": {\n \"GigaChat-2-Max\": { \"name\": \"GigaChat 2 Max\" },\n \"GigaChat-2-Pro\": { \"name\": \"GigaChat 2 Pro\" },\n \"GigaChat-2\": { \"name\": \"GigaChat 2 Lite\" },\n \"GigaChat\": { \"name\": \"GigaChat\" }\n }\n }\n }\n}\n<\/code><\/pre>\n<\/div>\n\nexport GIGACHAT_CREDENTIALS=\u0432\u0430\u0448_\u043a\u043b\u044e\u0447_\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438\nexport GIGACHAT_SCOPE=GIGACHAT_API_PERS\nexport NODE_EXTRA_CA_CERTS=\/\u043f\u0443\u0442\u044c\/\u043a\/russian_trusted_ca_bundle.pem\nopencode\n<\/code><\/pre>\n<\/div>\nModels<\/h2>\n
\n
\n{\"status\":404,\"message\":\"No such model\"}\n<\/code><\/pre>\n<\/div>\n\ncurl -H \"Authorization: Bearer <\u0442\u043e\u043a\u0435\u043d_\u0434\u043e\u0441\u0442\u0443\u043f\u0430>\" https:\/\/gigachat.devices.sberbank.ru\/api\/v1\/models\n<\/code><\/pre>\n<\/div>\n\n\/models\n<\/code><\/pre>\n<\/div>\nFirst launch in the project<\/h2>\n
\ncd \u0432\u0430\u0448_\u043f\u0440\u043e\u0435\u043a\u0442\nopencode\n<\/code><\/pre>\n<\/div>\n\n\/init\n<\/code><\/pre>\n<\/div>\nAlternative: local proxy<\/h2>\n
\n{\n \"$schema\": \"https:\/\/opencode.ai\/config.json\",\n \"provider\": {\n \"gigachat\": {\n \"npm\": \"@ai-sdk\/openai-compatible\",\n \"name\": \"GigaChat (proxy)\",\n \"options\": {\n \"baseURL\": \"http:\/\/localhost:8090\/v1\"\n },\n \"models\": {\n \"GigaChat-2-Max\": { \"name\": \"GigaChat 2 Max\" }\n }\n }\n }\n}\n<\/code><\/pre>\n<\/div>\nDeepSeek and other models via Cloud.ru<\/h2>\n
\ndeepseek-ai\/DeepSeek-V4.1-Flash\ndeepseek-ai\/DeepSeek-V4-Flash\ndeepseek-ai\/DeepSeek-V4-Pro\n<\/code><\/pre>\n<\/div>\n\n{\n \"$schema\": \"https:\/\/opencode.ai\/config.json\",\n \"provider\": {\n \"cloudru\": {\n \"npm\": \"@ai-sdk\/openai-compatible\",\n \"name\": \"Cloud.ru Foundation Models\",\n \"options\": {\n \"baseURL\": \"https:\/\/foundation-models.api.cloud.ru\/v1\",\n \"apiKey\": \"{env:CLOUDRU_API_KEY}\"\n },\n \"models\": {\n \"deepseek-ai\/DeepSeek-V4.1-Flash\": { \"name\": \"DeepSeek V4.1 Flash\", \"limit\": { \"context\": 1048576, \"output\": 1048576 } },\n \"deepseek-ai\/DeepSeek-V4-Flash\": { \"name\": \"DeepSeek V4 Flash\", \"limit\": { \"context\": 1048576, \"output\": 1048576 } },\n \"deepseek-ai\/DeepSeek-V4-Pro\": { \"name\": \"DeepSeek V4 Pro\", \"limit\": { \"context\": 1048576, \"output\": 1048576 } }\n }\n }\n }\n}\n<\/code><\/pre>\n<\/div>\n\nexport CLOUDRU_API_KEY=\u0432\u0430\u0448_\u043a\u043b\u044e\u0447_cloudru\nopencode\n<\/code><\/pre>\n<\/div>\n\n{\"message\":\"Not enough money\"}\n<\/code><\/pre>\n<\/div>\nWhat to pay attention to<\/h2>\n
\n
Links<\/h2>\n
\nhttps:\/\/opencode.ai\/docs\/providers\/<\/a>
\nhttps:\/\/developers.sber.ru\/studio\/<\/a>
\nhttps:\/\/developers.sber.ru\/docs\/ru\/gigachat\/guides\/main<\/a>
\nhttps:\/\/github.com\/nyddle\/gigachat-ai-sdk-provider<\/a>
\nhttps:\/\/github.com\/ai-forever\/gpt2giga<\/a>
\nhttps:\/\/cloud.ru\/docs\/foundation-models\/ug\/topics\/quickstart<\/a><\/p>\nSources<\/h2>\n
\nhttps:\/\/developers.sber.ru\/docs\/ru\/gigachat\/certificates<\/a>
\nhttps:\/\/developers.sber.ru\/docs\/ru\/gigachat\/models\/main<\/a>
\nhttps:\/\/developers.sber.ru\/docs\/ru\/gigachat\/guides\/selecting-a-model<\/a>
\nhttps:\/\/github.com\/nyddle\/gigachat-ai-sdk-provider<\/a>
\nhttps:\/\/github.com\/ai-forever\/gpt2giga<\/a>
\nhttps:\/\/cloud.ru\/docs\/foundation-models\/ug\/topics\/quickstart<\/a>
\nhttps:\/\/cloud.ru\/docs\/foundation-models\/ug\/topics\/overview__available__models<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"