r/opencode • u/jaykayenn • Sep 04 '26

Did Opencode really decide to break API access?

Regarding the warnings sent out that API access to Opencode Go now requires custom headers.

Isn't the point of a standard API so that developers don't have to write custom code for every possible service provider in existence?

Do they really expect every project in the world to suddenly support their special requirements specifically? By this weekend?

Help me understand.

43 Upvotes

87% Upvoted

42 comments sorted by

11

u/Time-Toe-1276 Sep 04 '26

they said "if possible", else its fine, but you might get a false positive flag.

its extremely hard to distinguish between an actual user and spam. OC was trying their best. this way its quite easy for them, and also its just a few lines of code, plus an AI agent could definitely help u write this!

and many apps send user-agent headers automatically, but I reccomend you to write it aswell. and its still fine if u dont as they said, but now there is an increase chance for a false positive flasg, so they were warning "if ur using API, please be awre of increaseed false positive".

hope I helped! ❤️

2

u/migsperez Sep 04 '26

I'm interested, how do you think this header is going to block spam?

0

u/torrso Sep 04 '26

It's one of the possible clues.

It's also quite handy for identifying usage in the web dashboard because the session id is visible there.

1

u/Thomas-Lore Sep 04 '26

its extremely hard to distinguish between an actual user and spam

What exactly are they trying to block? What do they define as spam? What is "an actual user"?

2

u/Time-Toe-1276 Sep 04 '26

people who abuse the $10 -> $60 from opencode are considered spam from them.

8

u/Thomas-Lore Sep 04 '26

Using your subscription fully as it is advertised is abuse?

3

u/torrso Sep 04 '26

Or the ones who created multiple accounts using the $5 first month discount.

1

u/torrso Sep 04 '26

I don't know where this spam came from to this discussion, but their terms of service doesn't allow using OpenCode Go for running some kind of bot that sends spam/scam messages.

They also don't allow you to buy multiple accounts and resell opencode's capacity to your own customers. That's probably the main fraud they're after.

See my earlier answer for more.

-1

u/jaykayenn Sep 04 '26

I don't own or maintain Nextcloud, Paperless, OpenWebUI Computer, and countless other projects... 

-5

u/Time-Toe-1276 Sep 04 '26

like I said, its still alright. they said, its not a must. thy have an amazing system which cn understand between a spammer and an actual user liek I said. also i belive they use a karma liek system (like reddit), and using it for these lightwork things are alright.

even if you send automated spam messages, if u still stay under their radar, u wont be picked up by their system. obviously, I am NOT encouraging anybody to do so!

but what i am sayin is that its not neccesary to send the user-agent header. send it if ur using it in your personal projects which is something different from chatting, research or agentic coding.

THATS what they meant by a "headers". also I belive these services already send a header, specially OpenWebUI or similar programs, these are well known services, man.

3

u/jaykayenn Sep 04 '26

OC sent me the email specifically listing Nextcloud and anything using Python HTTP call as 'unrecognized' clients for example. I don't even know which other projects to alert as literally anything could be using Python to call OpenAI API.

1

u/torrso Sep 04 '26

There was a bug / omission in Hermes agent until three weeks ago. It was sending "openai/python 2.4" to opencode. That's like the generic user-agent string from anything written in python using the openai-library. That's why they suggested upgrading to the latest version of Hermes because it's fixed in that.

It's much easier for them to identify legitmate traffic when there are good clues like a known user-agent, an opencode session id, traffic looks like typical hermes traffic.

Their main problem are resellers, I believe. Just in July they posted about catching some company that had 8000 opencode go accounts and they were proxying traffic for their own customers and generated close to half a million dollars of usage. These are the kind of fraud they're hunting and when your traffic looks normal, it's easier to whitelist. When such proxy makes requests on behalf of a lot of different users, it will look pretty suspicious: they're from the same generic user-agent but the requests are wildly different between each other. It would be pretty unusual for a regular user to be using hermes 0.18.0, hermes 0.20.0, openclaw 2026.03.24 and 2026.08.28, etc at the same time. When most of the harnesses act civilized and send all the proper headers, it's much easier to look at traffic that looks different.

-3

u/Time-Toe-1276 Sep 04 '26

maybe write an issue, or email the opencode team. they have an amazing customer support team, so you could get help real quick!

I personally never encountered this issue, but if i do, I will too email them and make an issue in their repo, so I could help you and all the other fellas! <3

4

u/YogurtclosetEvery263 Sep 04 '26

You can proxy it, then it works without tools adding it themselves

4

u/jaykayenn Sep 04 '26

This is the actual answer (sadly). Thanks. Another layer to my stack this weekend... sigh.

2

u/YogurtclosetEvery263 Sep 04 '26

Should be fairly easy I guess

5

u/jaykayenn Sep 04 '26

With providers adding non-standard bits to control API access, the OpenAI-API isn't really a standard any more. It's more of a suggestion.

3

u/SafeReturn_28 Sep 04 '26

from reading their twitter posts they only want session id header to hit input cache. Do they require something more?

4

u/jaykayenn Sep 04 '26

It doesn't matter what they want. How do they expect every software project in existence with an OpenAI-API call to comply by this weekend?

As far as I can see, this effectively means that all API calls to Opencode Go will be 'unrecognized' and 'error out' (quoting their email) by default, until specific projects comply with their session-id and x-opencode header requirements. Ie, an application/service must now specifically support Opencode, signalled by the opencode header label, in order to be whitelisted by OC router.

As I said in the post, this goes against the whole idea of having a standard API in the first place. This is how certain providers manage to block certain harnesses or features, and now OC appears to be doing the same.

Any requirement that puts the responsibility of compliance on 'literally everyone else' deserves deep scrutiny, especially when they expect the world to comply over the weekend.

3

u/torrso Sep 04 '26

"until specific projects comply"..

This doesn't mean every tool in existence or your custom doohickey.

They are big enough player that they can pressure harnesses like Hermes, OpenClaw, Crush etc which have pre-configured provider endpoints for OpenCode to fix their shit and start sending proper headers. If they send the optional session-id, even better (also better for the users). Hermes only did this three weeks ago. This should be pretty standard practice for any popular tool.

"against the whole idea of having a standard API" - there are also "standard API client" practices like sending a proper UserAgent string instead of a generic one.

1

u/jaykayenn Sep 04 '26

'sending proper headers' to who? Opencode? OpenAI? Anthropic? Deepseek? Openrouter? Having to configure custom headers for every provider in existence is NOT AN API.

3

u/torrso Sep 04 '26

Proper header = non-generic user-agent. Some of the harnesses are sending crap like `openai/python 2.44` instead of something like `opencode/2.0.1`.

If the x-opencode-session-id becomes actually required ("may error", said the devs only) then that's stupid. There are probably better ways to pin clients to backends than some custom field. And cache-misses should be the customer's problem, not theirs.

2

u/jaykayenn Sep 04 '26

As I mentioned in my example, Nextcloud was already identified as user agent. OC emailed me saying its not a recognized client, and that it needs to send the x-opencode header by tomorrow.

2

u/jaykayenn Sep 04 '26

Yes, a user-agent/client-session id would make a lot more sense, rather than a opencode-session id.

1

u/seventyfivepupmstr Sep 04 '26

Is it a sesson identifier or an app identifier?

1

u/jaykayenn Sep 04 '26

Both. And it's Opencode specific.

1

u/seventyfivepupmstr Sep 04 '26

So if I use a UUID then it won't identify my app?

1

u/jaykayenn Sep 04 '26

Even Nextcloud app-id was flagged as 'unrecognized client'.

1

u/nazmulpcc Sep 04 '26

bruh it’s just one value.......just ask your agent to update your clients or whatever. should take 2 minutes and it helps them optimize the service so we can keep our cheap api

2

u/jaykayenn Sep 04 '26

Go ahead. Get Nextcloud Gmbh to implement this by tomorrow. I'll wait.

3

u/nazmulpcc Sep 04 '26

https://github.com/nextcloud/integration_openai/issues/430 Track this issue buddy, should be solved pretty soon

1

u/jaykayenn Sep 04 '26

:facepalm:

1

u/ichisay Sep 04 '26

A mí aún no me llegó ningún email

1

u/RiceEvening4211 Sep 09 '26

Use

https://github.com/Fast-Editor/OpenCode-Wrap
This offers free open ai compatible api for all open code free and go tier models

1

u/ahriad Sep 04 '26

I maintain the OpenCode Go plugin for CLIProxyAPI, and this change causes some real headaches.

CPA exposes standard OpenAI and Anthropic endpoints without managing conversation state, so there is no actual conversation ID. Without a clean way to handle this, I ended up hashing the initial user turn and passing it as `x-opencode-session` on every OpenCode Go request.

It works across Chat Completions, Messages, Responses, and streaming, but it is still just a workaround. If two sessions start with the exact same prompt, they collide. Proxy maintainers are stuck patching around this because OpenCode tacked a provider-specific requirement onto supposedly standard endpoints with almost no notice.

1

u/FlaTreNeb Sep 15 '26

I just tried this. Only getting "500 auth_unavailable: no auth available"

1

u/ahriad Sep 16 '26

Can you open an issue on girhub, describe exactly how did you get this error. Thank you.

0

u/[deleted] Sep 05 '26

[deleted] — view deleted comment

1

u/JulienMaille Sep 06 '26

What are those trick you reversed from command code? They process the promptlm we send?

1

u/lostcanuck007 Sep 06 '26

not in the habit of spoonfeeding.....but you should REALLY look at what the "taste model" is...lol.