Skip to content

[Bug] OpenCode free tier models returning 403 FreeTierError via 9router proxy #4101

New issue
New issue
Open
Open
[Bug] OpenCode free tier models returning 403 FreeTierError via 9router proxy#4101

Description

@LustHK
LustHK
opened on Sep 17, 2026

Description

OpenCode free tier models (mimo-v2.5-free, muse-spark-1.2-contributor-free) started returning 403 FreeTierError when accessed through 9router proxy. This started approximately 15 minutes ago (Sep 16, 2026 ~20:55 UTC-3). The models were working fine for weeks before this.

Error Log

20:55:50 🟢 ▶ POST oc/mimo-v2.5-free → opencode/mimo-v2.5-free · FMT: openai→openai · STREAM · 2 MSG · 38 TOOL · ACC:Public
20:55:50 ℹ️ PROXY OPENCODE | mimo-v2.5-free | conn=Public | pool=*** | vercel-relay=https://elysium-hw3a89h6n-elysium13.vercel.app
20:55:50 🔵 ▶ POST oc/mimo-v2.5-free → opencode/mimo-v2.5-free · FMT: openai→openai · JSON · 2 MSG · ACC:Public
20:55:51 🔵 ✗ ERROR 403 · opencode/mimo-v2.5-free · 779ms URL: https://opencode.ai/zen/v1/chat/completions 403: {"type":"error","error":{"type":"FreeTierError","message":"Error from provider (Console): OpenCode's free tier can only be used from within OpenCode"}}
20:55:53 🟢 ✗ ERROR 403 · opencode/mimo-v2.5-free · 2196ms URL: https://opencode.ai/zen/v1/chat/completions 403: {"type":"error","error":{"type":"FreeTierError","message":"Error from provider (Console): OpenCode's free tier can only be used from within OpenCode"}}
20:55:53 🟢 ▶ POST oc/muse-spark-1.2-contributor-free → opencode/muse-spark-1.2-contributor-free · FMT: openai→openai-responses · STREAM · 1 MSG · 38 TOOL · ACC:Public
20:55:53 🟢 ✗ ERROR 403 · opencode/muse-spark-1.2-contributor-free · 420ms URL: https://opencode.ai/zen/v1/responses 403: {"type":"error","error":{"type":"FreeTierError","message":"Error from provider (Console): OpenCode's free tier can only be used from within OpenCode"}}

Environment

  • 9router version: latest
  • Models affected: oc/mimo-v2.5-free, oc/muse-spark-1.2-contributor-free
  • Provider: opencode (via opencode.ai/zen/v1)
  • Connection: Public

Additional Context

  • These models were working fine through 9router for weeks before this error started.
  • The error suggests OpenCode added server-side validation to ensure free tier models can only be accessed from the official OpenCode client.
  • This seems to be a new restriction deployed by OpenCode in the last ~15 minutes.
  • Other users may be affected by this change.

Expected Behavior

Free tier models should continue to work through the 9router proxy as they did before.

Actual Behavior

All free tier models return 403 with FreeTierError: OpenCode's free tier can only be used from within OpenCode.

Activity

  1. arwinwijaya commented on Sep 17, 2026

    @arwinwijaya
    arwinwijaya
    on Sep 17, 2026

    i have same issue

  2. anojndr commented on Sep 17, 2026

    @anojndr
    anojndr
    on Sep 17, 2026
    Contributor

    Identified the root cause of this error:

    OpenCode upstream deployed two server-side validation checks on free tier endpoints (/zen/v1/chat/completions and /zen/v1/responses) when using Authorization: Bearer public:

    1. User-Agent Header: Upstream requires User-Agent: opencode/<version> with version >= 1.17.0. Bare opencode or third-party client user agents trigger 403 FreeTierError (and versions < 1.17.0 receive 426 Upgrade Required). 9router was defaulting to bare User-Agent: opencode.
    2. Session Header (x-opencode-session): Upstream enforces OpenCode's canonical descending identifier format: ses_ + 12 hex timestamp characters + 14 Base62 characters (/^ses_[0-9a-f]{12}[0-9A-Za-z]{14}$/, 30 characters total). Missing headers or raw UUID formats trigger 403 FreeTierError.

    Fix submitted in PR #4105:

    • Defaults User-Agent to opencode/1.18.31 and validates downstream client versions.
    • Generates canonical OpenCode session IDs and deterministically translates downstream client sessions into valid OpenCode session format to preserve prompt caching and session affinity.
    • Eliminates mutable shared instance state on OpenCodeExecutor for safe concurrent request handling.
  3. achmadsy
    added a commit that references this issue on Sep 17, 2026

    fix(opencode): resolve 403 FreeTierError with canonical session forma…

    94fdb6b
  4. PineLu
    added a commit that references this issue on Sep 17, 2026

    [feat/combo-health-fallback] fix(opencode): resolve 403 FreeTierError…

    c12e263

  5. LustHK commented on Sep 17, 2026

    @LustHK
    LustHK
    on Sep 17, 2026
    Author

    Wow! The people here are really fast.

  6. anojndr commented on Sep 17, 2026

    @anojndr
    anojndr
    on Sep 17, 2026
    Contributor

    Update — my earlier comment here (PR #4105) was an incomplete fix: it covered only 2 of the 4 gates upstream enforces, which is why the 403 came back within hours.

    Live bisection with genuine opencode/1.18.31 + canonical ses_ held constant found the two missing gates Zen enforces with Bearer public:

    • Tool-signature gate: 0–3 tools → 403; the {bash, glob, grep, read} quartet → 200 on both /chat/completions and /responses. Extras allowed, fake names fail. Plain chat callers send no tools, so every such request 403s.
    • Streaming gate: stream:false → 403 on both endpoints even when everything else is valid.

    New PR #4132 completes the fingerprint: forces stream:true upstream (non-stream clients still get JSON via the existing forced-SSE path) and merges the missing quartet declarations, preserving caller tools verbatim. Verified live post-fix: mimo-v2.5-free, ling-3.0-flash-fin-free, nemotron-3.5/3-ultra-free, big-pickle, muse-spark-1.2/1.3-contributor-free all 200, including with non-stream flag. 65 opencode unit tests pass, baselines byte-equal.

  7. TEGAR-SRC
    added a commit that references this issue on Sep 17, 2026

    fix(opencode): complete free-tier client fingerprint to stop recurrin…

    12c0c8e
  8. YumamaX3
    added a commit that references this issue on Sep 17, 2026

    release(v0.9.64): the versioned gate — Zen's free tier answers again ⚿

    f08790b
  9. hodtien
    added a commit that references this issue on Sep 18, 2026

    fix(opencode): complete free-tier client fingerprint to stop recurrin…

    2130180

  10. nonamcabibaranani-design commented on Sep 18, 2026

    @nonamcabibaranani-design
    nonamcabibaranani-design
    on Sep 18, 2026

    +1, hitting the exact same via 9router proxy. Hope this gets a fix soon!

  11. nonamcabibaranani-design commented on Sep 18, 2026

    @nonamcabibaranani-design
    nonamcabibaranani-design
    on Sep 18, 2026

    +1, hitting the exact same FreeTierError via 9router proxy.

  12. YumamaX3
    added a commit that references this issue on Sep 18, 2026

    release(v0.9.64): the versioned gate — Zen's free tier answers again ⚿

    1c3421b
  13. rusak47
    added 7 commits that reference this issue on Sep 19, 2026

    fix(opencode): resolve 403 FreeTierError with canonical session forma…

    67d1664

    fix(opencode): complete free-tier client fingerprint to stop recurrin…

    57f39fe

    fix(opencode): complete free-tier client fingerprint to stop recurrin…

    17714da

    fix(opencode): resolve 403 FreeTierError with canonical session forma…

    6294dae

    fix(opencode): complete free-tier client fingerprint to stop recurrin…

    3f31147

    fix(opencode): complete free-tier client fingerprint to stop recurrin…

    44b7c57

    fix(opencode): complete free-tier client fingerprint to stop recurrin…

    161ab9d
  14. d0nj
    added a commit that references this issue on Oct 13, 2026

    fix(opencode): encode inverted timestamp in translated session IDs (d…

    35fb8f5
  15. decolua
    added a commit that references this issue on Oct 15, 2026

    fix(opencode): encode inverted timestamp in translated session IDs (#…

    ef4679d
  16. thunderkex
    added a commit that references this issue on Oct 16, 2026

    fix(opencode): encode inverted timestamp in translated session IDs (d…

    8c15705
  17. leon-marzahn
    added 2 commits that reference this issue on Oct 18, 2026

    Merge decolua/master v0.5.104 into fork (#15)

    75b064e

    feat(ui): warm-workbench redesign foundation, live Providers workbenc…

    214930a

  18. jauharymanshura9-max commented on Oct 19, 2026

    @jauharymanshura9-max
    jauharymanshura9-max
    on Oct 19, 2026

    Additional finding: IP-reputation gate separate from the fingerprint gate

    We've been running 9router with OpenCode free tier through a de-duplicated WARP IP pool (3 distinct egress addresses) and logging every request. Our data shows there are two separate 403 gates, not one:

    1. Fingerprint gate (what this issue covers): missing read tool, wrong User-Agent, wrong session format → "can only be used from within OpenCode"
    2. IP-reputation gate (new finding): even with correct fingerprint, certain IPs get rejected with "abusive traffic from this IP address"

    Quantitative evidence (1000 requests, ~8 hours):

    • Overall success: 94.8% (948/1000)
    • With 3 distinct WARP IPs: 98.2% (593/604)
    • With single IP (old setup): 73.2% (112/153)
    • All 52 errors were 403 FreeTierError — zero 429 quota errors

    Model-specific sensitivity to IP abuse:

    Model Success Rate
    deepseek-v4.1-flash-free(max) 98.8%
    big-pickle 75.9%
    mimo-v2.6-flash-free 62.5%

    Workaround that worked for us: Route 9router's OpenCode provider through Cloudflare WARP with multiple distinct egress IPs. De-duplicate the pool (WARP assigns from a small regional pool — nodes collide by default). Automatic failover on 403/429 across different IPs.

    Key insight for 9router: The fingerprint fix (this issue) solves gate #1, but gate #2 (IP abuse) still causes failures for users on flagged IP ranges. Even WARP IPs get flagged over time — a pool of 5+ distinct IPs with automatic rotation provides better sustained reliability.

  19. lydx9876
    added a commit that references this issue on Nov 6, 2026

    fix(opencode): encode inverted timestamp in translated session IDs (d…

    29cea4e
  20. aniruddhaadak80
    added a commit that references this issue on Nov 8, 2026

    fix(opencode): encode inverted timestamp in translated session IDs (d…

    b05312e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions