Introduction¶

DSH’s extension approach emphasizes pluggability; capabilities like third-party model login can be implemented as independent plugins. dsh-oauth-api targets this scenario: initiating third-party OAuth login within the DeepSeek Harness Web management interface, saving the token, and making the corresponding provider’s models appear in the official model selector.

Below, I will introduce which providers it supports, and how to complete installation, login, and verification locally.

What is it¶

dsh-oauth-api is an out-of-tree DeepSeek Harness plugin used for third-party OAuth login.

It is explicitly described as a community plugin, not an official DeepSeek product, nor an upstream PR. The repository path is hahaha-taotao/dsh-oauth-api, and the name in package.json is dsh-oauth. The independent author field is not provided in the materials, so this article references it by repository path. The license is MIT.

Core Features¶

After installation, the plugin adds a Settings -> OAuth Login view in the Web interface, displaying a card for each provider.

It supports the following four groups of providers:

Tokens are saved in the plugin’s own store:

$DSH_HOME/oauth/xai.json
$DSH_HOME/oauth/codex.json
$DSH_HOME/oauth/claude.json
$DSH_HOME/oauth/kimi.json

By default, $DSH_HOME is ~/.dsh.

The plugin also exposes two Cordis entries:

dsh-oauth-host
dsh-oauth-client

Installation and Activation¶

First, clone the repository, install dependencies, and build the local package, then add the current directory as a plugin to the web profile:

git clone https://github.com/hahaha-taotao/dsh-oauth-api.git
cd dsh-oauth-api
pnpm install
pnpm build
dsh plugin --profile web add .

After activation, you can check the configuration of the current web profile to confirm if the plugin is recognized:

dsh --profile web --dump-config

In the output, confirm that you can see the following two lines:

dsh-oauth-host
dsh-oauth-client

Typical Usage¶

1. Start the Web UI:

dsh web

2. Open Settings -> OAuth Login and click Login on the target provider card.

3. Complete the browser-side login steps:
   - Grok / xAI, Codex / ChatGPT, Kimi Code: Complete the device code flow.
   - Claude Code: Open the authorization URL, then paste code#state.

4. Select the corresponding group in the official model selector:

xai-oauth
codex-oauth
claude-oauth
kimi-oauth

Successful login does not automatically change the current default model. You need to manually select the corresponding provider group in the official model selector.

If using Grok and an “scope missing” error is prompted during reasoning, you can log in again. The Grok token requires the api:access scope.

Applicable Scenarios and Notes¶

Suitable for the following scenarios:
- Initiate third-party OAuth login uniformly in the DSH web profile.
- Save the tokens for Grok / xAI, Codex / ChatGPT, Claude Code, and Kimi Code in the plugin’s local store.
- Switch to the corresponding *-oauth group via the official model selector.

Usage notes:
- This is a community plugin, not an official DeepSeek product, nor an upstream PR.
- The community plugin directory is an independent site and is not equivalent to the official app store.
- The plugin runs with the permissions of the current dsh process; you should check the source code and license before installing.
- Tokens are only saved in this plugin’s store, with the default path located at ~/.dsh/oauth/.
- Successful login does not equal switching the default model; you need to select the corresponding provider group in the model selector.

Related Links¶

• GitHub repository: https://github.com/hahaha-taotao/dsh-oauth-api
• Plugin directory clue page (unverified): https://www.skillhub.cn/plugins/hahaha-taotao/dsh-oauth-api