Repository navigation
provider/opencode: free tier returns 403 FreeTierError on official 2.0.32 even with Console login and API key #56397
Description
Summary
On official OpenCode 2.0.32 (Linux, release build), every free-tier model returns HTTP 403 FreeTierError even though the client is the official CLI and the user has completed opencode auth login opencode. Paid models on the same credential return 402 Insufficient account funds, so authentication works and only the free-tier gate rejects the request.
Environment
- opencode version:
2.0.32 - OS:
Linux 7.0.0-38-generic #38-Ubuntu SMP PREEMPT_DYNAMIC x86_64 GNU/Linux(Ubuntu, desktop session, Wayland) - Terminal:
TERM=xterm-256color,COLORTERM=truecolor; issue reproduced in the Desktop/TUI app and inopencode run - Shell:
/usr/bin/zsh - Install/channel:
latestrelease, installed viahttps://opencode.ai/v2/installinto~/.opencode/bin(not a dev/git build) - Active plugins: none configured (
~/.config/opencode/opencode.jsonccontains only"permission": {"*": "allow"})
Reproduction
- Fresh login:
opencode auth login opencode→ OpenCode Console account, complete the device flow.opencode auth listthen showsOpenCode Console Personal stored. - Run
opencode run -m opencode/deepseek-v4.1-flash-free "hi" --format json. - Repeat with a personal Console API key (
API key (service account)login), and with no credential at all.
Expected Behavior
Free-tier models answer normally (they worked on the same machine two days earlier with opencode/mimo-v2.6-flash-free).
Actual Behavior
Immediate 403, no model call:
{"type":"error","error":{"type":"FreeTierError","message":"OpenCode's free tier can only be used from within OpenCode. Download it at https://opencode.ai and keep building."}}Log (~/.local/share/opencode/log/opencode.log):
level=ERROR message="Failed to drain Session" cause="AI.Error: OpenCode's free tier can only be used from within OpenCode..."
Server-side request log IDs for two of the rejected requests:
f71bd158-eabf-4387-a244-f75fc79a979696c6e52e-f8dd-46a7-af20-42907612a44e
Additional Context
Control experiment — the same credential is accepted for paid models:
The official client's own request is rejected. I captured the exact request the 2.0.32 CLI sends (by pointing the provider baseURL at a local mock) and replayed it verbatim:
POST /inference/openai/v1/chat/completions
Authorization: Bearer <console token>
User-Agent: opencode/latest/2.0.32/cli
x-opencode-client: cli
x-opencode-org-id: org_01M54...59DRG
x-opencode-project: f36e94ec...
x-opencode-session: ses_eb611f57affeH7LPDPnkBtm14N
x-opencode-session-id: ses_eb611f57affeH7LPDPnkBtm14N
x-session-id / x-session-affinity: ses_eb611f57affeH7LPDPnkBtm14N
b3 / traceparent: present
Replay result: 403. Variations all also 403:
- UA
opencode/1.18.31,opencode/latest/1.18.31/cli - Paths
/zen/v1/chat/completions,/zen/v1/responses,/inference/openai/v1/chat/completions - Tools array present (
read,bash, … up to 12 tools) vs. absent - Egress networks: Hong Kong, US (Kansas), mainland China direct
- Models:
deepseek-v4.1-flash-free,glm-5.3-flash-free,big-pickle,space-bunny-free,mimo-v2.6-flash-free,longcat-2.5-preview-free
Workarounds from the existing reports did not help: opencode auth login (Console OAuth), personal API key, opencode service restart, full app restart, brand-new session, no proxy, no config overrides (zen/v1 provider override confirmed absent), built-in build agent with all tools allowed.
Timeline: free models last succeeded on 2026-10-15 (mimo-v2.6-flash-free, finish: "stop", stored in session history). The failure started on 2026-10-17 before and after the automatic 2.0.31 → 2.0.32 update.
Account state: Personal workspace, balance $0.00, no payment method attached; free models should not require credit.
Activity
opencode-agent commentedon Oct 17, 2026
Thanks for the thorough report. The control experiment and the verbatim replay of the client's request make it clear the rejection happens in the hosted gateway, not in your local setup.
I think this is a duplicate of #56324. It reports the same failure on official v2.0.32: every free model gets an immediate 403
FreeTierErrorfrom about 2026-10-17. Commenters there see it across Windows, Linux and macOS, signed in or out, after reinstalls and on different networks.Possible duplicates and related issues, ordered from most to least likely:
Your request IDs (
f71bd158-…,96c6e52e-…) may help the team trace this. Consider adding them in a comment on #56324.The bot will close this issue as a duplicate in 1 day unless you reply explaining how your problem is different.
W1Real commentedon Oct 17, 2026
I'm on Windows 10
I'm having the same error since today. I never had that error before.
They must have changed something on their backend today.
Somehow inside of a virtual machine on my same machine/ip on the same windows version it worked without even having to login. 😑
It's not a v2 error necessarily, I was on an earlier older version when it began, I thought that updating would have helped it, it didn't.
My suspicion so far:
Only strange behavior that I must have given them was that I did go up to over half a million tokens with their free model, because I did turn off their auto-compaction in favor of the dcp plugin compaction plugin and it didn't trigger and I just kept letting it use more context. I was using DeepSeek v4.1 free yesterday when it went over their official token budget. Maybe they didn't like that and thought I wasn't using their official harness?
gabszap commentedon Oct 17, 2026
Just use cloudflare warp guys, full report here #56324 (comment)
Dante-dan commentedon Oct 18, 2026
Source trace for the gateway investigation: the proxy explicitly delegates free-tier access to new inference, forwards the client IP and passes through 403 responses, and binds to the separately deployed
opencode-inferenceservice.The next useful check is in that service's admission logs: correlate the two request IDs already in the report (
f71bd158-eabf-4387-a244-f75fc79a9796,96c6e52e-f8dd-46a7-af20-42907612a44e) with the actual rejection condition. The network-only A/B successes in #56324 support network-sensitive enforcement for those users, but this report's failures across several exits do not establish an account, VPN or IP-reputation cause. This is a static source trace, not a reproduction of the hosted check.opencode-agent commentedon Oct 18, 2026
We haven't heard back saying how this differs from #56324, so I'm closing this as a duplicate. The free-tier
FreeTierErroron official 2.0.32 is tracked there, and many users are seeing the same thing.Your replay of the client's request, the paid-model controls and the request IDs (
f71bd158-eabf-4387-a244-f75fc79a9796,96c6e52e-f8dd-46a7-af20-42907612a44e) are still useful. Please add them in a comment on #56324 so the team can trace them. If your problem turns out to be different, reply here and we can reopen.