Failing to authenticate into web UI when username or password is set #6586

Open
opened 2026-02-16 18:04:40 -05:00 by yindo · 2 comments
Owner

Originally created by @thdxg on GitHub (Jan 17, 2026).

Originally assigned to: @adamdotdevin on GitHub.

Description

I set the environment variables OPENCODE_SERVER_USERNAME and OPENCODE_SERVER_PASSWORD, and then started a web UI using the opencode web command. However, when I open the server URL on browser, the authentication dialog keeps opening up even when I put correct username and password.

The server logs just say failed, and the subsequent run of opencode fails with an error saying Unauthorized.

If I unset the environment variables, opencode works again.

Plugins

No response

OpenCode version

1.1.21

Steps to reproduce

  1. Set OPENCODE_SERVER_USERNAME and OPENCODE_SERVER_PASSWORD environment variables
  2. Run opencode web --> cannot authenticate with the correct username and password
  3. Run opencode --> fails with an error Unauthorized
  4. Unset OPENCODE_SERVER_USERNAME and OPENCODE_SERVER_PASSWORD
  5. opencode works again

Screenshot and/or share link

Image

Operating System

macOS 26.3

Terminal

Ghostty

Originally created by @thdxg on GitHub (Jan 17, 2026). Originally assigned to: @adamdotdevin on GitHub. ### Description I set the environment variables `OPENCODE_SERVER_USERNAME` and `OPENCODE_SERVER_PASSWORD`, and then started a web UI using the `opencode web` command. However, when I open the server URL on browser, the authentication dialog keeps opening up even when I put correct username and password. The server logs just say `failed`, and the subsequent run of `opencode` fails with an error saying `Unauthorized`. If I unset the environment variables, `opencode` works again. ### Plugins _No response_ ### OpenCode version 1.1.21 ### Steps to reproduce 1. Set `OPENCODE_SERVER_USERNAME` and `OPENCODE_SERVER_PASSWORD` environment variables 2. Run `opencode web` --> cannot authenticate with the correct username and password 3. Run `opencode` --> fails with an error `Unauthorized` 4. Unset `OPENCODE_SERVER_USERNAME` and `OPENCODE_SERVER_PASSWORD` 5. `opencode` works again ### Screenshot and/or share link <img width="1250" height="731" alt="Image" src="https://github.com/user-attachments/assets/309d7bd9-1466-4b82-aec5-b0a4eac143fc" /> ### Operating System macOS 26.3 ### Terminal Ghostty
yindo added the bugweb labels 2026-02-16 18:04:40 -05:00
Author
Owner

@github-actions[bot] commented on GitHub (Jan 17, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #8676: Plugin client returns 401 Unauthorized when OPENCODE_SERVER_PASSWORD is set (Desktop)
  • #8173: OPENCODE_SERVER_PASSWORD in env prevents user from working in TUI
  • #9011: Cannot 'attach' to an opencode server with a password

All three issues relate to authentication failures when OPENCODE_SERVER_PASSWORD environment variable is set, which appears to be a broader problem with how password-protected servers handle client authentication.

Feel free to ignore if your specific case differs from these.

@github-actions[bot] commented on GitHub (Jan 17, 2026): This issue might be a duplicate of existing issues. Please check: - #8676: Plugin client returns 401 Unauthorized when OPENCODE_SERVER_PASSWORD is set (Desktop) - #8173: OPENCODE_SERVER_PASSWORD in env prevents user from working in TUI - #9011: Cannot 'attach' to an opencode server with a password All three issues relate to authentication failures when OPENCODE_SERVER_PASSWORD environment variable is set, which appears to be a broader problem with how password-protected servers handle client authentication. Feel free to ignore if your specific case differs from these.
Author
Owner

@LeonMueller-OneAndOnly commented on GitHub (Jan 17, 2026):

This issue is now fixed by PR #9095, which completes the authentication fix started in PR #8179. The new PR addresses the HTTP server authentication path when TUI and server are started alongside with a password.

@LeonMueller-OneAndOnly commented on GitHub (Jan 17, 2026): This issue is now fixed by PR #9095, which completes the authentication fix started in PR #8179. The new PR addresses the HTTP server authentication path when TUI and server are started alongside with a password.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#6586