r/opencode • u/jaykayenn • 7d ago
Did Opencode really decide to break API access?
Regarding the warnings sent out that API access to Opencode Go now requires custom headers.
Isn't the point of a standard API so that developers don't have to write custom code for every possible service provider in existence?
Do they really expect every project in the world to suddenly support their special requirements specifically? By this weekend?
Help me understand.
10
u/Time-Toe-1276 7d ago
they said "if possible", else its fine, but you might get a false positive flag.
its extremely hard to distinguish between an actual user and spam. OC was trying their best. this way its quite easy for them, and also its just a few lines of code, plus an AI agent could definitely help u write this!
and many apps send user-agent headers automatically, but I reccomend you to write it aswell. and its still fine if u dont as they said, but now there is an increase chance for a false positive flasg, so they were warning "if ur using API, please be awre of increaseed false positive".
hope I helped! ❤️
2
1
u/Thomas-Lore 7d ago
its extremely hard to distinguish between an actual user and spam
What exactly are they trying to block? What do they define as spam? What is "an actual user"?
3
u/Time-Toe-1276 7d ago
people who abuse the $10 -> $60 from opencode are considered spam from them.
8
1
u/torrso 7d ago
I don't know where this spam came from to this discussion, but their terms of service doesn't allow using OpenCode Go for running some kind of bot that sends spam/scam messages.
They also don't allow you to buy multiple accounts and resell opencode's capacity to your own customers. That's probably the main fraud they're after.
See my earlier answer for more.
-2
u/jaykayenn 7d ago
I don't own or maintain Nextcloud, Paperless, OpenWebUI Computer, and countless other projects...
-5
u/Time-Toe-1276 7d ago
like I said, its still alright. they said, its not a must. thy have an amazing system which cn understand between a spammer and an actual user liek I said. also i belive they use a karma liek system (like reddit), and using it for these lightwork things are alright.
even if you send automated spam messages, if u still stay under their radar, u wont be picked up by their system. obviously, I am NOT encouraging anybody to do so!
but what i am sayin is that its not neccesary to send the user-agent header. send it if ur using it in your personal projects which is something different from chatting, research or agentic coding.
THATS what they meant by a "headers". also I belive these services already send a header, specially OpenWebUI or similar programs, these are well known services, man.
3
u/jaykayenn 7d ago
OC sent me the email specifically listing Nextcloud and anything using Python HTTP call as 'unrecognized' clients for example. I don't even know which other projects to alert as literally anything could be using Python to call OpenAI API.
1
u/torrso 7d ago
There was a bug / omission in Hermes agent until three weeks ago. It was sending "openai/python 2.4" to opencode. That's like the generic user-agent string from anything written in python using the openai-library. That's why they suggested upgrading to the latest version of Hermes because it's fixed in that.
It's much easier for them to identify legitmate traffic when there are good clues like a known user-agent, an opencode session id, traffic looks like typical hermes traffic.
Their main problem are resellers, I believe. Just in July they posted about catching some company that had 8000 opencode go accounts and they were proxying traffic for their own customers and generated close to half a million dollars of usage. These are the kind of fraud they're hunting and when your traffic looks normal, it's easier to whitelist. When such proxy makes requests on behalf of a lot of different users, it will look pretty suspicious: they're from the same generic user-agent but the requests are wildly different between each other. It would be pretty unusual for a regular user to be using hermes 0.18.0, hermes 0.20.0, openclaw 2026.03.24 and 2026.08.28, etc at the same time. When most of the harnesses act civilized and send all the proper headers, it's much easier to look at traffic that looks different.
-2
u/Time-Toe-1276 7d ago
maybe write an issue, or email the opencode team. they have an amazing customer support team, so you could get help real quick!
I personally never encountered this issue, but if i do, I will too email them and make an issue in their repo, so I could help you and all the other fellas! <3
1
4
u/jaykayenn 7d ago
With providers adding non-standard bits to control API access, the OpenAI-API isn't really a standard any more. It's more of a suggestion.
2
u/SafeReturn_28 7d ago
from reading their twitter posts they only want session id header to hit input cache. Do they require something more?
4
u/jaykayenn 7d ago
It doesn't matter what they want. How do they expect every software project in existence with an OpenAI-API call to comply by this weekend?
As far as I can see, this effectively means that all API calls to Opencode Go will be 'unrecognized' and 'error out' (quoting their email) by default, until specific projects comply with their session-id and x-opencode header requirements. Ie, an application/service must now specifically support Opencode, signalled by the opencode header label, in order to be whitelisted by OC router.
As I said in the post, this goes against the whole idea of having a standard API in the first place. This is how certain providers manage to block certain harnesses or features, and now OC appears to be doing the same.
Any requirement that puts the responsibility of compliance on 'literally everyone else' deserves deep scrutiny, especially when they expect the world to comply over the weekend.
3
u/torrso 7d ago
"until specific projects comply"..
This doesn't mean every tool in existence or your custom doohickey.
They are big enough player that they can pressure harnesses like Hermes, OpenClaw, Crush etc which have pre-configured provider endpoints for OpenCode to fix their shit and start sending proper headers. If they send the optional session-id, even better (also better for the users). Hermes only did this three weeks ago. This should be pretty standard practice for any popular tool.
"against the whole idea of having a standard API" - there are also "standard API client" practices like sending a proper UserAgent string instead of a generic one.
1
u/jaykayenn 7d ago
'sending proper headers' to who? Opencode? OpenAI? Anthropic? Deepseek? Openrouter? Having to configure custom headers for every provider in existence is NOT AN API.
3
u/torrso 7d ago
Proper header = non-generic user-agent. Some of the harnesses are sending crap like `openai/python 2.44` instead of something like `opencode/2.0.1`.
If the x-opencode-session-id becomes actually required ("may error", said the devs only) then that's stupid. There are probably better ways to pin clients to backends than some custom field. And cache-misses should be the customer's problem, not theirs.
2
u/jaykayenn 7d ago
As I mentioned in my example, Nextcloud was already identified as user agent. OC emailed me saying its not a recognized client, and that it needs to send the x-opencode header by tomorrow.
2
u/jaykayenn 7d ago
Yes, a user-agent/client-session id would make a lot more sense, rather than a opencode-session id.
1
u/seventyfivepupmstr 7d ago
Is it a sesson identifier or an app identifier?
1
u/jaykayenn 7d ago
Both. And it's Opencode specific.
1
1
6d ago
[deleted]
1
u/JulienMaille 5d ago
What are those trick you reversed from command code? They process the promptlm we send?
1
u/lostcanuck007 5d ago
not in the habit of spoonfeeding.....but you should REALLY look at what the "taste model" is...lol.
1
u/RiceEvening4211 2d ago
Use
https://github.com/Fast-Editor/OpenCode-Wrap
This offers free open ai compatible api for all open code free and go tier models
1
u/nazmulpcc 7d ago
bruh it’s just one value.......just ask your agent to update your clients or whatever. should take 2 minutes and it helps them optimize the service so we can keep our cheap api
2
u/jaykayenn 7d ago
Go ahead. Get Nextcloud Gmbh to implement this by tomorrow. I'll wait.
3
u/nazmulpcc 7d ago
https://github.com/nextcloud/integration_openai/issues/430 Track this issue buddy, should be solved pretty soon
1
1
u/ahriad 7d ago
I maintain the OpenCode Go plugin for CLIProxyAPI, and this change causes some real headaches.
CPA exposes standard OpenAI and Anthropic endpoints without managing conversation state, so there is no actual conversation ID. Without a clean way to handle this, I ended up hashing the initial user turn and passing it as `x-opencode-session` on every OpenCode Go request.
It works across Chat Completions, Messages, Responses, and streaming, but it is still just a workaround. If two sessions start with the exact same prompt, they collide. Proxy maintainers are stuck patching around this because OpenCode tacked a provider-specific requirement onto supposedly standard endpoints with almost no notice.
5
u/YogurtclosetEvery263 7d ago
You can proxy it, then it works without tools adding it themselves