API Keys

API keys allow you to authenticate programmatic access to the Clove API without requiring interactive login. You can manage your keys from Settings > API Keys.

Key Limits

You can have a maximum of 3 active API keys at any time. The settings page shows your current count (e.g., "1 / 3 active keys"). You must disable or delete an existing key before creating a new one if you are at the limit.

Creating an API Key

1. Go to Settings > API Keys.
2. Click Create API Key.
3. Enter a descriptive name for the key (e.g., "CI Pipeline", "Development").
4. Select an expiration period:
   • 30 days
   • 60 days
   • 90 days (default)
   • 180 days
   • 365 days
5. Click Create.

After creation, you will see both the API Key ID and the Secret Key. Copy buttons are provided for each.

warning

The secret key is only displayed once at creation time. Copy it immediately and store it in a secure location. You will not be able to view it again.

Use a model you have access to

When you connect a coding tool with your API key, make sure it is set to a model your organization actually has access to. If a request fails because the model is unavailable, use the opencode model picker to switch to one you have access to. Third Loop for opencode offers three models: 3L-Small, 3L-Standard, and 3L-Large.

• 3L-Small — A faster, less expensive model. Use it for simple or low-stakes tasks where top-tier quality isn't required.
• 3L-Standard — The default model. Best all-around fit for coding tasks and most everyday work.
• 3L-Large — The most capable model. Reserve it for complex or high-stakes tasks.

Only use models provided by Third Loop to protect your data. Tools like opencode may offer other models, but Third Loop only manages and protects this subset of available models.

Managing API Keys

Your keys are displayed as cards showing:

• Name — The label you gave the key.
• API Key ID — The unique identifier (always visible).
• Status — Current state of the key.
• Created date — When the key was generated.
• Expires date — When the key will automatically expire.
• Last used — When the key was last used for authentication, or "Never used".

Key Statuses

Status	Meaning
Active	The key is valid and can be used for authentication.
Suspended	The key has been manually disabled and cannot authenticate until re-enabled.
Expired	The key has passed its expiration date and can no longer be used.
Compromised	The key has been flagged as compromised and is permanently disabled.

Actions

Click the menu icon on any key card to access available actions. The actions depend on the key's current status:

• Active keys — You can Disable or Delete them.
• Suspended keys — You can Enable or Delete them.
• Expired or Compromised keys — You can only Delete them.

Disabling a Key

Disabling a key temporarily suspends it. The key still exists and can be re-enabled later. This is useful if you suspect a key may be compromised but want to investigate before permanently deleting it.

Enabling a Key

Re-enabling a suspended key restores it to active status so it can authenticate again.

Deleting a Key

Deleting a key permanently removes it. This action cannot be undone. You will be asked to confirm before the key is deleted.

Using Your API Key with opencode

You can use your Clove API key with opencode, an open-source terminal-based AI coding agent. This routes all requests through your organization's Third Loop instance.

Additionally, the official OpenCode VS Code extension is provided by SST at opencode

The Settings > API Keys page has an Open Code Configuration section that generates the JSON below for you, pre-filled with your organization's API domain. Use the Copy or Download button there instead of typing it out by hand.

1. Create an API key in Settings > API Keys.

2. Copy the generated configuration (or download it as opencode.json) from the Open Code Configuration section. It looks like this, with <api_domain> and <api_version> filled in for your organization automatically:

   {
     "$schema": "https://opencode.ai/config.json",
     "model": "thirdloop/3L-Standard",
     "provider": {
       "thirdloop": {
         "npm": "@ai-sdk/anthropic",
         "name": "Third Loop",
         "options": {
           "baseURL": "https://<api_domain>/<api_version>",
           "apiKey": "{env:THIRDLOOP_API_KEY}",
           "headers": {
             "anthropic-version": "2023-06-01"
           }
         },
         "models": {
           "3L-Small": { "name": "Small Model" },
           "3L-Standard": { "name": "Standard Model" },
           "3L-Large": { "name": "Large Model" }
         }
       }
     }
   }

3. Save the file. You have two choices for where:

   • Global (applies to every project) — save it as opencode.json in your OpenCode config directory: ~/.config/opencode/opencode.json on Linux/macOS, or %USERPROFILE%\.config\opencode\opencode.json on Windows.
   • Project-only — save it as opencode.json in that project's root instead.
   note

   The filename must be exactly opencode.json (no leading dot). opencode will silently ignore .opencode.json and fall back to its default providers.

4. Set the THIRDLOOP_API_KEY environment variable to your combined API Key ID and Secret Key, joined by a semicolon (e.g. ak_...;sk_...).

   Linux — Bash

   echo 'export THIRDLOOP_API_KEY="<api_key_id>;<api_secret_key>"' >> ~/.bashrc && source ~/.bashrc

   macOS — Zsh

   echo 'export THIRDLOOP_API_KEY="<api_key_id>;<api_secret_key>"' >> ~/.zshrc && source ~/.zshrc

   Windows — PowerShell

   [Environment]::SetEnvironmentVariable('THIRDLOOP_API_KEY', '<api_key_id>;<api_secret_key>', 'User')

   The Linux/macOS commands persist the variable and load it into your current shell. On Windows, open a new terminal for the change to take effect.

5. Run opencode from your project root:

   opencode

   The Third Loop models will be in the model list. You can switch between them using the model picker.

tip

Because the only secret in opencode.json is referenced via {env:THIRDLOOP_API_KEY} — not inlined — the file is safe to commit to source control. This lets your whole team share a single canonical configuration. Just don't replace the {env:...} placeholder with a real key.

Verifying opencode Is Routed Through Third Loop

After your first prompt, refresh Settings > API Keys. The Last used timestamp on your key should update to the current time. If it still shows "Never used," opencode isn't reaching Third Loop — double-check the filename, the environment variable, and that the config was saved to the right path.

Why Route AI Coding Tools Through Third Loop?

Running tools like opencode through your organization's Third Loop instance instead of directly through another provider gives you several advantages:

• Privacy — Your prompts and code stay within your organization's managed environment. Third Loop does not use your data for model training, so sensitive code and proprietary information remain private.
• Cost control — Usage is tracked and managed through your organization's Third Loop account. Administrators can monitor token consumption across the team..
• Access management — API keys are scoped to your organization and can be disabled or deleted at any time. If someone leaves the team or a key is compromised, access can be revoked immediately without affecting other users.
• Audit logging — All requests are logged through your Third Loop instance, giving your organization visibility into how AI tools are being used across the team.
• Consistency — Everyone on your team connects through the same endpoint with the same policies, ensuring a uniform experience and making it easier to enforce usage guidelines.

Custom Instructions with AGENTS.md

You can provide custom instructions to OpenCode to customize its behavior for your specific project or workflow. OpenCode reads instructions from AGENTS.md files, which work similarly to Cursor's rules files.

Project-Specific Instructions

Create an AGENTS.md file in your project root to provide project-specific guidance:

Example AGENTS.md:

# Third Loop Development Guidelines

## Project Context
This project uses Third Loop's API for AI model access. All code must route through 
our organization's Third Loop instance for compliance and audit logging.

## Code Standards
- Always verify the OpenCode provider shows "Third Loop" before starting work
- Use TypeScript with strict mode enabled
- Follow our internal security guidelines for handling API keys
- Test commands should use: `npm test`
- Build commands should use: `npm run build`

## Important Conventions
- API keys should never be committed to the repository
- All environment variables should be documented in .env.example
- Session tracking must be enabled for audit compliance

This file should be committed to your Git repository so the instructions are shared across your team.

Global Instructions

You can also create a global AGENTS.md file at ~/.config/opencode/AGENTS.md (Linux/macOS) or %APPDATA%\opencode\AGENTS.md (Windows) for personal preferences that apply to all your projects:

Example global AGENTS.md:

# My Personal OpenCode Preferences

## Communication Style
- Be concise and direct
- Always explain why you're making specific changes
- Ask before making destructive operations

## Third Loop
- I always use Third Loop for work projects
- Remind me if I'm not connected to Third Loop when working in ~/work/ directories

Using opencode.json for Instructions

You can also reference instruction files directly in your configuration:

Global config (~/.config/opencode/opencode.json):

{
  "$schema": "https://opencode.ai/config.json",
  "instructions": [
    "~/.config/opencode/third-loop-guidelines.md",
    "~/Documents/coding-standards.md"
  ]
}

Project config (opencode.json):

{
  "$schema": "https://opencode.ai/config.json",
  "instructions": [
    "CONTRIBUTING.md",
    "docs/development-guidelines.md",
    ".cursor/rules/*.md"
  ]
}

You can even reference remote URLs:

{
  "$schema": "https://opencode.ai/config.json",
  "instructions": [
    "https://raw.githubusercontent.com/your-org/standards/main/opencode-rules.md"
  ]
}

Initializing AGENTS.md

OpenCode can automatically generate an AGENTS.md file for your project by running:

/init

This command will scan your repository and create project-specific guidance including build commands, test commands, architecture notes, and conventions.

File Precedence

When OpenCode starts, it looks for instruction files in this order:

1. Project files - AGENTS.md in your project directory (or parent directories)
2. Global file - ~/.config/opencode/AGENTS.md
3. Config-specified files - Files listed in the instructions field of your opencode.json

All matching instruction files are combined and provided to OpenCode as context.

For more details about custom instructions, see the OpenCode Rules documentation.

Best Practices

• Name keys descriptively so you can identify their purpose later (e.g., "Production Backend", "Local Development").
• Rotate keys regularly — Use shorter expiration periods for sensitive environments.
• Disable before deleting — If you suspect a key is compromised, disable it first while you investigate.
• Never share secret keys in code repositories, chat messages, or documentation.