Tell your own gateway who sent each request
OpenCode can now send your custom provider a signed token naming the member or service account behind each model request.
If your provider is a gateway you run, turn on Send identity on its page under Providers. Every model request
OpenCode sends to it then carries an x-opencode-actor header. It's a JWT signed by OpenCode that names the member
(user ID and email) or service account that sent the request, with the workspace and request IDs, and the session ID
when the client sends one.
Your gateway can verify the token with the keys at https://opencode.ai/inference/.well-known/jwks.json, then log or
restrict requests by sender. Each token lasts 120 seconds, and its audience is the provider's base URL, so a token sent
to one provider doesn't verify at another.
The setting is off by default. Providers still at their vendor's own API, such as OpenAI's, don't show it, and changing the base URL turns it off. The Providers docs list every claim and show how to verify the token.