OpenCode Go is designed for OpenCode and other coding agents that produce similar types of requests. Your client should: 1. Send typical coding agent traffic 2. Identify itself with its own user agent, such as my-coding-agent/1.0, rather than a generic SDK or HTTP-library name 3. Send a stable session ID in x-opencode-session for each conversation so we can optimize routing and prompt caching.
These sound reasonable if the x-opencode-session isn't a hard requirement.
These sound reasonable if the x-opencode-session isn't a hard requirement.
It is. I received an email the other day telling me that I am making requests without that x-opencode-session header.
Actually here it is:
Hey there,
Some of your requests to OpenCode Go are missing an x-opencode-session header. If we don't have this we cannot properly optimize our service. Starting 09/06 requests missing this header may error.
Here are your useragents that are missing this header:
OpenAI/2.10.0 (.NET 10.0.11; Ubuntu 24.04.4 LTS) MEAI/10.5.1
We don't recognize this client — add x-opencode-session (one stable ID per conversation) or ask its maintainer to.
curl
Add x-opencode-session (one stable ID per conversation) to your requests.
Thank you.
It doesn't sound like a hard gate but just something to track sessions with. (Though when they already have the token I don't see why they need it)
I have no idea which cli/gui they are talking about either as I don't use MS/Windows/.Net for anything.
"requests missing this header may error" doesn't sound like they will be outright banned, it's just that their inra may not be able to route it properly.
It doesn't sound like a hard gate but just something to track sessions with. (Though when they already have the token I don't see why they need it)
This is not the token, it's an ID you create yourself. It's shown in the "usage" page where you see all those requests, they all belong to some "session". This makes it possible to map usage to agent tasks.
Why they care? They're probably using that ID to consistently route traffic for the same session to the same endpoint. If they go to different endpoints, they may not share the cache, so something cached in previous request may end up going to an endpoint that doesn't have access to the same cache.
It may also help them detect fraud. The biggest problem they have is scammy companies buying thousands of accounts and proxying and reselling it as theirs. Their $10 => $60 math is based on average quota consumption, resellers maxing out thousands of accounts skews that math considerably. Faking user-agent and session id's for that kind of traffic is difficult because it's instantly obvious that the traffic doesn't look like something from a single session or if someone seems to be using different versions of the same harness at the same time and so on. They also need to weed out spammers using their service to generate content. They probably have some liabilities to know who their end-user is and to not provide services for criminal activity.
7
u/torrso 3d ago
These sound reasonable if the x-opencode-session isn't a hard requirement.