Error from provider (Console): OpenCode's free tier can only be used from within OpenCode · Issue #49433 · anomalyco/opencode · GitHub
Skip to content

Error from provider (Console): OpenCode's free tier can only be used from within OpenCode #49433

Closed as not planned
Closed as not planned
Error from provider (Console): OpenCode's free tier can only be used from within OpenCode#49433
Assignees
fwang

Description

@GooseOb
GooseOb
opened on Sep 17, 2026

Description

Occurs for any model

Plugins

No response

OpenCode version

Latest from pacman, at the moment

$ opencode --version
1.3.17

Steps to reproduce

No response

Screenshot and/or share link

Image

Operating System

Linux 7.2.4-arch1-2

Terminal

Ghostty

Activity

  1. github-actions
    assigned
    fwang
    on Sep 17, 2026

  2. github-actions commented on Sep 17, 2026

    @github-actions
    github-actionsBot
    on Sep 17, 2026 – with GitHub Actions
    Contributor

    This issue might be a duplicate of existing issues. Please check:

    The error message is slightly different ("can only be used from within OpenCode" vs "1.17.0 or newer is required"), but both relate to the free tier Console provider check. If your issue is distinct, please clarify what client/interface you are using (TUI, Desktop, or API) and whether you have any custom provider configuration.

  3. LouisLau-art commented on Sep 17, 2026

    @LouisLau-art
    LouisLau-art
    on Sep 17, 2026

    Root cause: the free-tier gate reads the client version from User-Agent; non-release version strings are rejected

    Environment — Arch Linux, two builds on the same machine, identical config ({"$schema":...} minimal), network and proxy, anonymous (no OpenCode credential):

    • opencode-git 1.18.31.r12.g88c6c7a (archlinuxcn) → ❌ fails
    • opencode 1.18.31 (official release build) → ✅ works
    • 1.18.29 (official release) → ✅ works

    Repro: opencode run -m opencode/mimo-v2.5-free "hi" → Error from provider (Console): OpenCode's free tier can only be used from within OpenCode (deterministic, fails in under a second)

    Evidence:

    1. Captured both clients' outbound requests against a local mock (provider.opencode.options.baseURL override). Headers identical except the version inside User-Agent:

      • accepted: opencode/1.18.29 ai-sdk/provider-utils/4.0.23 runtime/bun/1.4.0
      • rejected: opencode/1.18.31.r12.g88c6c7a ai-sdk/provider-utils/4.0.23 runtime/bun/1.4.2

      Authorization: Bearer public and all x-opencode-* headers were the same.

    2. Decisive test: in a local copy of the failing binary, patched only the version literal (1.18.31.r12.g88c6c7a → 1.18.31, same byte length, nothing else) → free tier works immediately. The version string is the discriminator.

    Implication: any development/nightly/-git build whose version is a git-describe string (<tag>.rN.gSHA) is not valid semver and gets rejected. The 1.17.0 or newer is required variant (#49430, #49431) looks like the same version-parsing gate with a different message.

    Suggested fixes (either side): report a sanitized semver in User-Agent for non-release builds (keep the full git-describe string in --version/logs), or make the server tolerate such strings / gate on an explicit client marker instead of the version.

  4. joaomj commented on Sep 17, 2026

    @joaomj
    joaomj
    on Sep 17, 2026

    A third-party client (pi) hits the same gate, and the User-Agent version is only one of two checks

    Thanks @LouisLau-art for isolating the User-Agent check. I hit the same error from a different client and reproduced it on purpose. This adds a second, independent condition the gate enforces.

    Context

    pi is a coding agent with a built-in opencode provider. It sends x-opencode-client: pi for attribution. Since 2026-09-17 the free tier returns for every free model:

    OpenAI API error (403): {"type":"FreeTierError","message":"Error from provider (Console): OpenCode's free tier can only be used from within OpenCode"}

    The error appears on two hosts (macOS and Windows), with the same key and the same pi version, and without the OpenCode CLI involved. That is why I looked at the request fingerprint rather than at the account.

    Method

    I sent direct requests to https://opencode.ai/zen/v1/responses with Authorization: Bearer public (anonymous free tier) and a minimal JSON body, then varied one header at a time.

    Finding 1 — User-Agent must be opencode/<recent semver>

    User-Agent Result
    opencode/1.18.31 200
    opencode/latest/1.18.31/cli 200
    opencode/999.0.0 200
    OpenCode/1.18.31 200
    opencode/0.0.0 426
    opencode/latest 403
    opencode/ 403
    opencode (no slash) 403
    pi (darwin 25.6.0; arm64) 403
    curl/8.7.1 403
    OpenAI/JS 6.40.0 403
    header absent 403

    This matches #49430/#49431 (1.17.0 or newer is required) and the git-describe rejection. The trailing SDK tags (ai-sdk/provider-utils/... runtime/bun/...) are not required: plain opencode/1.18.31 passes, and OpenCode/1.18.31 passes, so the match is case-insensitive.

    Finding 2 — x-opencode-session must be an OpenCode session ID

    With User-Agent: opencode/1.18.31 fixed, the session header is a second independent gate. The accepted format is ses_ + 12 hex characters + 14 base62 characters, i.e. what Identifier.create produces in packages/opencode/src/id/id.ts.

    x-opencode-session Result
    ses_<12 hex><14 base62> 200
    ses_ + 12 hex time + AAAAAAAAAAAAAA 403
    ses_AAAAAAAAAAAA + 14 random base62 403
    <uuid> (e.g. 01a0af13-c6df-73c6-8803-9e6d9c720da7) 403
    same value without the ses_ prefix 403
    empty string 403
    header absent 403

    Notes from the same tests:

    • The 12-hex time component is not checked for recency. Timestamps from now back to one year ago pass; an all-A component (which decodes to ~1971) fails. So the gate looks for a plausible timestamp, not an exact one.
    • x-opencode-client is not validated. cli and pi both pass with a valid session.
    • x-opencode-request and x-opencode-project are not required.
    • The body is irrelevant: a full agent payload and a minimal {"model","input","stream"} payload behave the same.
    • The gate is not key-based: Bearer public and a real account key both pass with a valid fingerprint.

    So a request to the free tier needs both an opencode/-style User-Agent and a ses_-formatted session ID. A third-party client that reports an honest User-Agent (as pi does) is rejected twice: once on the UA and once on its own UUID session.

    Request

    Could the OpenCode team make the free-tier client requirements explicit in the docs? Concretely:

    1. Is the free tier intended to be limited to the official OpenCode client? If known third-party clients are supported, what should they send? pi already sends x-opencode-client: pi, which suggests third-party attribution was intended.
    2. Can you document the accepted User-Agent form and the required x-opencode-session format in one place, so client authors can comply instead of reverse-engineering the edge service? A 1.17.0 or newer minimum and a session-ID requirement would be enough.
    3. If the intent is official-client-only, please state that, and say whether an explicit client marker (rather than a spoofable UA/version and session format) is planned.

    I am happy to test any documented header contract and to adjust pi accordingly.

  5. mvalentsev
    added a commit that references this issue on Sep 17, 2026

    feat: a lane that stops working while its vendor is silent gets a dat…

    d2dc5ca

  6. GooseOb commented on Sep 17, 2026

    @GooseOb
    GooseOb
    on Sep 17, 2026
    Author

    @joaomj unlike opencode, pi works for me tho

    Image

  7. joaomj commented on Sep 17, 2026

    @joaomj
    joaomj
    on Sep 17, 2026

    @GooseOb which provider are you using in pi? The exact provider (opencode, opencode-go, opencode-zen etc).

  8. GooseOb commented on Sep 17, 2026

    @GooseOb
    GooseOb
    on Sep 17, 2026
    Author

    @joaomj oops, I tried opencode and acutally got the error

    Error: 403: {"type":"FreeTierError","message":"Error from provider (Console): OpenCode's free tier can only be used from within OpenCode"}

    Apparently I was using opencode-free, which was provided by pi-free extension

  9. Tranberry commented on Sep 17, 2026

    @Tranberry
    Tranberry
    on Sep 17, 2026

    Image got the same/similar error tried another free model with the same "warning" (bug?)

    Was working then suddenly got the warning, updated to latest version still get the warninf.

    OS: Windows 11
    Terminal: PowerShell 7.6.5

  10. Simonko-912 commented on Sep 17, 2026

    @Simonko-912
    Simonko-912
    on Sep 17, 2026

    Screenshot_2026-09-17-19-17-20-201_com.server.auditor.ssh.client-edit.jpg
    Currently on newest ver, other agents running rn work with same model (big pickle free), but this single one at compaction got the same error

  11. SuperYosh23 commented on Sep 17, 2026

    @SuperYosh23
    SuperYosh23
    on Sep 17, 2026

    This is really pissing me off as i'm trying to work on a project, please fix this asap.
    I am also using arch linux (omarchy)

    Image

  12. FortuneDan commented on Sep 17, 2026

    @FortuneDan
    FortuneDan
    on Sep 17, 2026

    same issue on big pickle, it specifically happens when it goes to perform compaction. Haven't changed anything in weeks, been using the same version and model and now suddenly today this happens

  13. Simonko-912 commented on Sep 17, 2026

    @Simonko-912
    Simonko-912
    on Sep 17, 2026

    same issue on big pickle, it specifically happens when it goes to perform compaction. Haven't changed anything in weeks, been using the same version and model and now suddenly today this happens

    For me, in the same session, i tried everything with big pickle, and nothing worked, still got the same error, and some other sessions simply work

  14. michaelcoyote commented on Sep 17, 2026

    @michaelcoyote
    michaelcoyote
    on Sep 17, 2026

    Yep, just started for me too after a few weeks of it working fine:

    Error from provider (Console): OpenCode's free tier can only be used from within OpenCode
▣  Compaction · Big Pickle

    opencode version is 1.18.30
    tty is Ghostty v1.3.1
    OS is currently MacOS.

    I'm guessing this isn't on my end though the way everyone is showing up here at once.

  15. SuperYosh23 commented on Sep 17, 2026

    @SuperYosh23
    SuperYosh23
    on Sep 17, 2026

    Yeah, this was working fine for me yesterday also but now it's not

  16. 38 remaining items

  17. Corniel commented on Sep 22, 2026

    @Corniel
    Corniel
    on Sep 22, 2026

    WIth this version I can not longer reproduce this issue.

  18. gainfully4302 commented on Sep 23, 2026

    @gainfully4302
    gainfully4302
    on Sep 23, 2026

    Update: applied the workaround from #49680 step by step on 1.18.32 (Windows, Chocolatey) and the 403 persists for the plan agent:

    • Updated to 1.18.32
    • Set global permissions bash/glob/grep/read to allow
    • opencode auth logout opencode + opencode auth login --provider opencode
    • Restarted opencode, started a fresh session

    opencode run --agent plan --model opencode/big-pickle still returns FreeTierError" / HTTP 403 (log id 75c7ff8e-9f06-40b3-9ab7-d8d5668c8375), while --agent build` works fine.

    Since the only difference between the two requests is the agent toolset (plan runs without edit/write/bash in my config), this strongly suggests the gateway is inspecting the request toolset rather than the client or session. The documented read-only plan agent therefore cannot work on the free tier at all.

    The Plan mode agent is working for me now but my read only Q/A agent that I created with markdown is triggering the "OpenCode's free tier can only be used..." error, so you might be on to something.

  19. joshportman commented on Sep 23, 2026

    @joshportman
    joshportman
    on Sep 23, 2026

    Thanks for investigating this. We can confirm a permission-dependent reproduction on Linux with the official npm CLI 1.18.32, model opencode/big-pickle, and a configured Zen API credential.

    Failing command in an empty project:

    OPENCODE_PERMISSION='{"*":"deny"}' opencode run --pure --agent build --format json --model opencode/big-pickle 'Do not use tools or access files. Reply exactly BIG_PICKLE_OK.'

    This returns HTTP 403 / FreeTierError: "OpenCode's free tier can only be used from within OpenCode". We also observed the same error on 1.18.31. Failed request log ID: bcc8d6a8-aa88-48f0-9152-2b9cb5f08e49.

    Using approval-gated tools instead of removing them resolves it here:

    OPENCODE_PERMISSION='{"*":"ask","external_directory":"deny"}' opencode run --pure --agent build --format json --model opencode/big-pickle 'Do not use any tools or access files. Reply exactly BIG_PICKLE_OK.'

    Result: BIG_PICKLE_OK, exit 0. Confirmed again after persisting permission: {"*":"ask", ...} in the global config and removing the environment override. Both successful requests reported cost 0, and neither executed a tool. No client/header spoofing, custom endpoint, or paid-model fallback was used.

    Could the free-tier validation support legitimate deny/reduced-toolset configurations, or at least return an actionable error explaining the incompatibility? The current message led us to investigate account authentication and client versions unnecessarily. Happy to provide additional sanitized details. Thank you!

  20. orangeguitar commented on Sep 23, 2026

    @orangeguitar
    orangeguitar
    on Sep 23, 2026

    Reproduction: free-tier gate fails when an agent sets permission.bash: deny

    OpenCode: 1.18.32 (Linux)
    Provider: opencode (Zen free models: mimo-v2.6-flash-free, big-pickle)
    Not reproduced on: opencode-go free models (different header branch)

    Summary

    Custom agents with permission: bash: deny reliably get:

    Error from provider (Console): OpenCode's free tier can only be used from within OpenCode

    The same agent with bash: ask (or without a bash permission) succeeds
    immediately. Built-in plan / build succeed. This looks like the free-tier
    client gate misclassifies requests when bash is fully denied — not a missing
    User-Agent/session header from an external harness.

    Controlled A/B/A/B (same binary, same model, ~2026-09-23)

    Agent file ~/.config/opencode/agents/chat.md (custom, mode: primary):

    permission.bash Result
    deny ❌ free-tier error (reproduced 2/2, then 2/2 again)
    ask ✅ success (then ✅ again)

    Minimal repro agent:

    ---
description: test
mode: primary
permission:
  bash: deny
---
Reply briefly.
    opencode run --agent chat --model opencode/mimo-v2.6-flash-free "Reply with exactly: HI"
# → Error: OpenCode's free tier can only be used from within OpenCode

    Change to bash: ask → succeeds. Pattern form also fails:

    permission:
  bash:
    "*": deny

    Other single-key tests with bash omitted all succeeded on Zen free:
    edit: deny, write: deny, lsp: deny, todowrite: deny, tavily_: ask,
    temperature: 0.5.

    Cross-agent: a throwaway custom agent with only bash: deny also failed; a
    minimal custom agent without a bash permission succeeded. So it is not
    specific to the agent name chat.

    Other observations

    • Title agent on the same host: gpt-5.4-nano → Model access is disabled (separate issue).
    • Workaround: use bash: ask (or omit bash) on agents that must use Zen free models.
    • Timeline matches the ~Sep 17 free-tier gate tighten; last successful
      chat + Zen free on this machine was 2026-09-08 (before the gate).

    Environment

    • opencode --version: 1.18.32
    • OS: Linux
    • Plugins: claude-mem (no chat.headers hooks found)

    Happy to run more header-level tests if maintainers need them.

  21. Eriol1805 commented on Sep 23, 2026

    @Eriol1805
    Eriol1805
    on Sep 23, 2026

    Confirmed the workaround on Windows, Chocolatey 1.18.32: changing the agent's permission.bash from deny to ask resolves the 403 for the plan agent with opencode/big-pickle (verified both via CLI opencode run --agent plan returning the expected reply at cost 0, and in interactive plan-mode sessions). edit/write remain deny, so the agent is still effectively read-only — every execution prompts for approval.

    Thanks to @orangeguitar for isolating the trigger to bash: deny, and to @sekedus, @joshportman and @gainfully4302 for the reproductions. The current error message (OpenCode's free tier can only be used from within OpenCode) really sends you down the wrong path (account/auth/client version) — an actionable message about the toolset requirement would save a lot of debugging. Thanks!

  22. masuda-masuo commented on Sep 24, 2026

    @masuda-masuo
    masuda-masuo
    on Sep 24, 2026

    Adding a precise bisect in case it helps, since you asked about custom setups.

    Setup: opencode 1.18.31 (official npm release, Linux/WSL2). Logged into Zen + Go. opencode is driven headlessly (opencode serve / opencode run) by an orchestrator. The worker agents are custom primary agents that start from "*": deny and only allow MCP tools that operate inside a sandbox container. Built-in bash/read are denied on purpose, so an automated worker can never touch the host.

    Repro: a minimal custom agent and opencode run --agent <name> -m opencode/mimo-v2.6-flash-free "Reply with just OK", changing only one permission line each time:

    agent permission result
    (none) OK
    bash: deny 403 "free tier can only be used from within OpenCode"
    read: deny 403
    edit / glob / grep / webfetch / task: deny OK
    "*": deny, bash: allow 403
    "*": deny, bash: ask, read: ask OK

    So the gate seems to require both bash and read to be present in the request's tool list. read: deny alone triggers it too, which I don't think has been reported here yet. ask passes because the tool stays in the list.

    The same agents keep working on paid models: 187 completed Go runs since 2026-09-19, 0 rejected. Every free model is rejected; before 2026-09-19 the same agents had 459 completed free runs.

    Restricting bash/read is a safety choice for unattended runs, not a sign of a different harness. It would be great if denying those tools didn't count as "not OpenCode". Happy to provide more details if useful.

  23. SamiNassim commented on Oct 3, 2026

    @SamiNassim
    SamiNassim
    on Oct 3, 2026

    I just started getting this error too. I’m not sure what’s causing it, it started happening randomly.
    Happy to provide more information needed to debug this.

    macOS 26.6.2
    OpenCode 1.18.34 (updated from 1.18.32 to see if that would fix it, but it didn’t)
    Nothing custom.

    I was using MiMo-V2.6-Flash. Tried to switch to Space Bunny but same thing.
    Image

  24. juliancruzsanchez commented on Oct 3, 2026

    @juliancruzsanchez
    juliancruzsanchez
    on Oct 3, 2026

    I am having this issue now

    Image

  25. dl9sau commented on Oct 3, 2026

    @dl9sau
    dl9sau
    on Oct 3, 2026

    Me too. "Error: Error from provider (Console): OpenCode's free tier can only be used from within OpenCode".
    Had also this error some weeks ago. Resolved by upgrading opencode.
    I just upgraded opencode on my macos (macports: version opencode @2.0.21 llm/opencode) -- previously 1.18.31 iirc. But this time the error stays.

  26. raihanmd commented on Oct 3, 2026

    @raihanmd
    raihanmd
    on Oct 3, 2026

    same here Error: Error from provider (Console): OpenCode's free tier can only be used from within OpenCode
    ❯ opencode --version
    1.18.34

  27. mycr0ft
    added a commit that references this issue on Oct 11, 2026

    feat: steer users away from OpenCode free-tier models

    ca918ac

  28. thdxr commented on Oct 11, 2026

    @thdxr
    thdxr
    on Oct 11, 2026
    Member

    Thanks for the report! OpenCode 2.0 is now out and development is focused on V2, so we're closing issues filed against OpenCode 1. Please upgrade (opencode upgrade --major, details: https://anoma.ly/notes/opencode-2-0), and if this is still relevant on 2.0, reopen this issue or open a new one with your 2.0 version.

    — from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊

  29. thdxr
    closed this as not plannedon Oct 11, 2026

  30. k00shi commented on Oct 17, 2026

    @k00shi
    k00shi
    on Oct 17, 2026

    Still happening in v2.

  31. hossainchisty commented on Oct 17, 2026

    @hossainchisty
    hossainchisty
    on Oct 17, 2026

    I'm using the official OpenCode Desktop app on macOS, but every prompt fails with this error:

    Session failed
OpenCode's free tier can only be used from within OpenCode. Download it at https://opencode.ai and keep building.

    Environment:

    OS: macOS

    OpenCode version: v2.0.32

    Installed via: Homebrew

    Troubleshooting tried:

    Re-authenticated using opencode auth login opencode

    Tested from /tmp to rule out project-specific configuration

    Installed and tested the official Desktop app

    Verified the installed version

    The issue persists. Is this a known Console free-tier issue, and is there a recommended fix?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions