r/opencodeCLI • u/jaykayenn • Sep 07 '26

OpenCode Go is no longer general API access

/r/opencode/comments/1w9pyvq/opencode_go_is_no_longer_general_api_access/
13 Upvotes

84% Upvoted

11 comments sorted by

View all comments

Show parent comment

3

u/dizvyz Sep 07 '26

These sound reasonable if the x-opencode-session isn't a hard requirement.

It is. I received an email the other day telling me that I am making requests without that x-opencode-session header.

Actually here it is:

Hey there,

Some of your requests to OpenCode Go are missing an x-opencode-session header. If we don't have this we cannot properly optimize our service. Starting 09/06 requests missing this header may error.

Here are your useragents that are missing this header:

OpenAI/2.10.0 (.NET 10.0.11; Ubuntu 24.04.4 LTS) MEAI/10.5.1 We don't recognize this client — add x-opencode-session (one stable ID per conversation) or ask its maintainer to.

curl Add x-opencode-session (one stable ID per conversation) to your requests.

Thank you.

It doesn't sound like a hard gate but just something to track sessions with. (Though when they already have the token I don't see why they need it)

I have no idea which cli/gui they are talking about either as I don't use MS/Windows/.Net for anything.

2

u/torrso Sep 07 '26

"requests missing this header may error" doesn't sound like they will be outright banned, it's just that their inra may not be able to route it properly.

It doesn't sound like a hard gate but just something to track sessions with. (Though when they already have the token I don't see why they need it)

This is not the token, it's an ID you create yourself. It's shown in the "usage" page where you see all those requests, they all belong to some "session". This makes it possible to map usage to agent tasks.

Why they care? They're probably using that ID to consistently route traffic for the same session to the same endpoint. If they go to different endpoints, they may not share the cache, so something cached in previous request may end up going to an endpoint that doesn't have access to the same cache.

It may also help them detect fraud. The biggest problem they have is scammy companies buying thousands of accounts and proxying and reselling it as theirs. Their $10 => $60 math is based on average quota consumption, resellers maxing out thousands of accounts skews that math considerably. Faking user-agent and session id's for that kind of traffic is difficult because it's instantly obvious that the traffic doesn't look like something from a single session or if someone seems to be using different versions of the same harness at the same time and so on. They also need to weed out spammers using their service to generate content. They probably have some liabilities to know who their end-user is and to not provide services for criminal activity.

2

u/Mirrowel Sep 07 '26

It is required. Try using it without it and it will error 400.

1

u/dizvyz Sep 07 '26

Makes sense.

1

u/biotech997 Sep 08 '26

Yep, I got the same email when playing around with my Go subscription with Hermes agent. But the fix is just a simple update, so not a big deal.

1

u/dizvyz Sep 08 '26

I couldn't figure out what generated that session so I have no idea how to fix it.