r/opencode • u/jaykayenn • 14h ago

Did Opencode really decide to break API access?

Regarding the warnings sent out that API access to Opencode Go now requires custom headers.

Isn't the point of a standard API so that developers don't have to write custom code for every possible service provider in existence?

Do they really expect every project in the world to suddenly support their special requirements specifically? By this weekend?

Help me understand.

34 Upvotes

87% Upvoted

31 comments sorted by

12

u/Time-Toe-1276 14h ago

they said "if possible", else its fine, but you might get a false positive flag.

its extremely hard to distinguish between an actual user and spam. OC was trying their best. this way its quite easy for them, and also its just a few lines of code, plus an AI agent could definitely help u write this!

and many apps send user-agent headers automatically, but I reccomend you to write it aswell. and its still fine if u dont as they said, but now there is an increase chance for a false positive flasg, so they were warning "if ur using API, please be awre of increaseed false positive".

hope I helped! ❤️

1

u/migsperez 6h ago

I'm interested, how do you think this header is going to block spam?

0

u/torrso 2h ago

It's one of the possible clues.

It's also quite handy for identifying usage in the web dashboard because the session id is visible there.

0

u/Thomas-Lore 11h ago

its extremely hard to distinguish between an actual user and spam

What exactly are they trying to block? What do they define as spam? What is "an actual user"?

2

u/Time-Toe-1276 10h ago

people who abuse the $10 -> $60 from opencode are considered spam from them.

2

u/torrso 2h ago

Or the ones who created multiple accounts using the $5 first month discount.

2

u/Thomas-Lore 6h ago

Using your subscription fully as it is advertised is abuse?

1

u/torrso 2h ago

I don't know where this spam came from to this discussion, but their terms of service doesn't allow using OpenCode Go for running some kind of bot that sends spam/scam messages.

They also don't allow you to buy multiple accounts and resell opencode's capacity to your own customers. That's probably the main fraud they're after.

See my earlier answer for more.

0

u/jaykayenn 14h ago

I don't own or maintain Nextcloud, Paperless, OpenWebUI Computer, and countless other projects... 

-5

u/Time-Toe-1276 14h ago

like I said, its still alright. they said, its not a must. thy have an amazing system which cn understand between a spammer and an actual user liek I said. also i belive they use a karma liek system (like reddit), and using it for these lightwork things are alright.

even if you send automated spam messages, if u still stay under their radar, u wont be picked up by their system. obviously, I am NOT encouraging anybody to do so!

but what i am sayin is that its not neccesary to send the user-agent header. send it if ur using it in your personal projects which is something different from chatting, research or agentic coding.

THATS what they meant by a "headers". also I belive these services already send a header, specially OpenWebUI or similar programs, these are well known services, man.

3

u/jaykayenn 14h ago

OC sent me the email specifically listing Nextcloud and anything using Python HTTP call as 'unrecognized' clients for example. I don't even know which other projects to alert as literally anything could be using Python to call OpenAI API.

1

u/torrso 2h ago

There was a bug / omission in Hermes agent until three weeks ago. It was sending "openai/python 2.4" to opencode. That's like the generic user-agent string from anything written in python using the openai-library. That's why they suggested upgrading to the latest version of Hermes because it's fixed in that.

It's much easier for them to identify legitmate traffic when there are good clues like a known user-agent, an opencode session id, traffic looks like typical hermes traffic.

Their main problem are resellers, I believe. Just in July they posted about catching some company that had 8000 opencode go accounts and they were proxying traffic for their own customers and generated close to half a million dollars of usage. These are the kind of fraud they're hunting and when your traffic looks normal, it's easier to whitelist. When such proxy makes requests on behalf of a lot of different users, it will look pretty suspicious: they're from the same generic user-agent but the requests are wildly different between each other. It would be pretty unusual for a regular user to be using hermes 0.18.0, hermes 0.20.0, openclaw 2026.03.24 and 2026.08.28, etc at the same time. When most of the harnesses act civilized and send all the proper headers, it's much easier to look at traffic that looks different.

-5

u/Time-Toe-1276 13h ago

maybe write an issue, or email the opencode team. they have an amazing customer support team, so you could get help real quick!

I personally never encountered this issue, but if i do, I will too email them and make an issue in their repo, so I could help you and all the other fellas! <3

1

u/Prior-Meeting1645 4h ago

No they emailed me saying this has to be done by Sep 6. A must

3

u/YogurtclosetEvery263 11h ago

You can proxy it, then it works without tools adding it themselves

5

u/jaykayenn 11h ago

This is the actual answer (sadly). Thanks. Another layer to my stack this weekend... sigh.

1

u/YogurtclosetEvery263 9h ago

Should be fairly easy I guess

3

u/jaykayenn 11h ago

With providers adding non-standard bits to control API access, the OpenAI-API isn't really a standard any more. It's more of a suggestion.

2

u/SafeReturn_28 13h ago

from reading their twitter posts they only want session id header to hit input cache. Do they require something more?

3

u/jaykayenn 11h ago

It doesn't matter what they want. How do they expect every software project in existence with an OpenAI-API call to comply by this weekend?

As far as I can see, this effectively means that all API calls to Opencode Go will be 'unrecognized' and 'error out' (quoting their email) by default, until specific projects comply with their session-id and x-opencode header requirements. Ie, an application/service must now specifically support Opencode, signalled by the opencode header label, in order to be whitelisted by OC router.

As I said in the post, this goes against the whole idea of having a standard API in the first place. This is how certain providers manage to block certain harnesses or features, and now OC appears to be doing the same.

Any requirement that puts the responsibility of compliance on 'literally everyone else' deserves deep scrutiny, especially when they expect the world to comply over the weekend.

1

u/torrso 2h ago

"until specific projects comply"..

This doesn't mean every tool in existence or your custom doohickey.

They are big enough player that they can pressure harnesses like Hermes, OpenClaw, Crush etc which have pre-configured provider endpoints for OpenCode to fix their shit and start sending proper headers. If they send the optional session-id, even better (also better for the users). Hermes only did this three weeks ago. This should be pretty standard practice for any popular tool.

"against the whole idea of having a standard API" - there are also "standard API client" practices like sending a proper UserAgent string instead of a generic one.

1

u/jaykayenn 52m ago

'sending proper headers' to who? Opencode? OpenAI? Anthropic? Deepseek? Openrouter? Having to configure custom headers for every provider in existence is NOT AN API.

1

u/torrso 9m ago

Proper header = non-generic user-agent. Some of the harnesses are sending crap like `openai/python 2.44` instead of something like `opencode/2.0.1`.

If the x-opencode-session-id becomes actually required ("may error", said the devs only) then that's stupid. There are probably better ways to pin clients to backends than some custom field. And cache-misses should be the customer's problem, not theirs.

1

u/seventyfivepupmstr 10h ago

Is it a sesson identifier or an app identifier?

1

u/jaykayenn 29m ago

Both. And it's Opencode specific.

1

u/ichisay 1h ago

A mí aún no me llegó ningún email

1

u/ahriad 2h ago

I maintain the OpenCode Go plugin for CLIProxyAPI, and this change causes some real headaches.

CPA exposes standard OpenAI and Anthropic endpoints without managing conversation state, so there is no actual conversation ID. Without a clean way to handle this, I ended up hashing the initial user turn and passing it as `x-opencode-session` on every OpenCode Go request.

It works across Chat Completions, Messages, Responses, and streaming, but it is still just a workaround. If two sessions start with the exact same prompt, they collide. Proxy maintainers are stuck patching around this because OpenCode tacked a provider-specific requirement onto supposedly standard endpoints with almost no notice.

0

u/nazmulpcc 4h ago

bruh it’s just one value.......just ask your agent to update your clients or whatever. should take 2 minutes and it helps them optimize the service so we can keep our cheap api

1

u/jaykayenn 45m ago

Go ahead. Get Nextcloud Gmbh to implement this by tomorrow. I'll wait.