Introduction¶

DeepSeek Harness (DSH) typically integrates LLMs via API keys. The official dsh-llm-pi-ai uses API key authentication and does not perform OAuth login or token refresh. If you already have subscriptions like Grok, GitHub Copilot, ChatGPT/Codex, Anthropic, OpenRouter, or Kimi For Coding, and wish to use them directly within your DSH profile without maintaining a separate set of API keys, this guide introduces dsh-llm-oauth.

What is This¶

dsh-llm-oauth is a standalone OAuth / subscription-plan LLM plugin, maintained by ziyou979 under the MIT license.

It installs into a specified DSH profile without patching the Harness repository. The plugin reuses the installed @earendil-works/pi-ai model directory and uses a durable CredentialStore to refresh subscription tokens on the request path. Model IDs are sourced from the installed @earendil-works/pi-ai; the plugin does not maintain its own private model list.

Repository URL:

https://github.com/ziyou979/dsh-llm-oauth

Supported Subscriptions¶

The plugin supports the following subscription provider IDs:

After installation, the plugin does not immediately populate all models into the selector. Only enabled providers list their models; once enabled, these providers appear in Settings → Models, alongside the API-key routes.

Installation¶

Run the installation command:

dsh plugin --profile web add github:ziyou979/dsh-llm-oauth

If you have a local checkout, you can install from the local path:

dsh plugin --profile web add ./dsh-llm-oauth

After installation, you can check the configuration layers of the current profile:

dsh --profile web --dump-config

When installing from Git, the profile’s pnpm-workspace.yaml may need to allow the prepare build:

allowBuilds:
  dsh-llm-oauth: true

Enable, Sign in, Disable¶

When using these three concepts, first distinguish the actions:

• Enable: Registers the LLM route, making the provider appear in the model selector.
• Sign in: Writes the token to the local credential file.
• Disable: Removes the provider from the model selector but retains the stored token.

Credentials are stored at:

$DSH_HOME/pi-ai-oauth.json

If $DSH_HOME is not set, the default path is:

~/.dsh/pi-ai-oauth.json

In the Web UI chat, you can execute:

/oauth status
/oauth list
/oauth enable xai
/oauth login xai
/oauth disable xai
/oauth logout xai

Using xai as an example, a common workflow is:

/oauth enable xai
/oauth login xai
/oauth status

For terminal login, you can run:

node bin/login.mjs --list
node bin/login.mjs xai

You can also enable providers directly in settings.yaml without using the UI:

llm-oauth:
  providers:
    xai: {}

Web Settings Page and HTTP API¶

The Web UI provides a Settings → OAuth / Subscriptions page. This page is used to manage subscription providers, offering:

• Enable
• Disable
• Sign in
• Sign out

Providers that are enabled and signed in appear in Settings → Models, alongside API-key routes.

The plugin also provides same-origin host HTTP APIs:

ChatGPT / Codex Device Code Login¶

openai-codex uses ChatGPT / Codex plan OAuth login, not the standard OpenAI API key.

Before using openai-codex, you need to enable device code authorization in ChatGPT:

1. Open ChatGPT settings, go to Apps & connectors, or find Connectors / Codex based on the current UI.
2. Locate Codex and enable Enable device code authorization for Codex.
3. Return to the dsh-llm-oauth OAuth / Subscriptions page and perform sign in for openai-codex.
4. Open the authorization URL and enter the code displayed on the page.

There is a clear account risk: logging into Codex/ChatGPT via device code or other unofficial client OAuth may result in the ChatGPT account being restricted or banned. If attempting this path, it is recommended not to use important accounts or accounts with financial stakes that cannot afford loss. The plugin cannot prevent or reverse bans on your behalf.

Boundary with llm-pi-ai¶

dsh-llm-oauth targets the subscription / OAuth path. The standard API-key path continues to be handled as before.

Note: Declaring the same provider ID in the llm-pi-ai: configuration section will throw a DUPLICATE_ADAPTER error.

The division of labor can be as follows:

• Subscription / OAuth: dsh-llm-oauth
• Standard OpenAI API, DeepSeek official: Continue using API keys

Limitations and Notes¶

The following limitations come from the plugin documentation; confirm whether your requirements match before use:

• The model list follows @earendil-works/pi-ai; the plugin does not maintain a private model list.
• No image / vision path.
• No full native replay signatures.
• No in-browser OAuth callback server; uses device code / open URL.
• Standard OpenAI API and DeepSeek official still use API keys.
• Curated editors in Settings → Models are for API keys; OAuth enable and login are completed on the Settings → OAuth / Subscriptions page.

Additionally, after installing the plugin into a profile, it will be loaded and run by the current DSH process, and will write tokens to the local credential file. Before adding it to a production profile, it is recommended to review the GitHub source code, MIT license, and dependencies; exercise caution with providers like openai-codex that carry account risks.

Conclusion¶

dsh-llm-oauth solves a specific problem: integrating subscription-based LLMs within a DSH profile while maintaining a clear boundary from the API-key route. It does not modify the Harness repository, does not maintain a private model list, and does not replace the standard API-key path.

GitHub Repository:

https://github.com/ziyou979/dsh-llm-oauth