Repository navigation
opencode serve requires HTTP auth, breaking SDK / third-party clients #31254
Description
Problem
opencode serve (v1.15.13, installed via Homebrew) returns HTTP 401 for all API endpoints:
$ curl -s http://127.0.0.1:18750/provider
HTTP 401
www-authenticate: Basic realm="Secure Area"
All endpoints tested return 401: /provider, /api/provider, /config/providers, /session, etc.
Impact
This breaks any third-party tool using the OpenCode SDK (@opencode-ai/sdk) to communicate with a local server. For example, Paseo can no longer integrate with OpenCode >= 1.15.0.
The SDK v1.16.2 supports HTTP auth via Config.auth (basic / bearer), but the server credentials are not discoverable:
- No auth info in stdout/stderr
- No auth tables in
~/.local/share/opencode/opencode.db - No relevant environment variables
- The SDK does not auto-authenticate
Request
One of:
- Add a
--no-auth/--insecureflag for local development - Document how external SDK clients should authenticate (e.g., generate and expose a server token)
- Update the SDK to auto-authenticate when connecting to a local server
Environment
- opencode: 1.15.13 (Homebrew)
- macOS 15
- Node v24
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Jun 7, 2026
This issue doesn't fully meet our contributing guidelines.
What needs to be fixed:
--no-authflag / token exposure).Please edit this issue to address the above within 2 hours, or it will be automatically closed.
This issue might be a duplicate of existing issues. Please check:
opencode serve, and proposes similar solutions (Bearer token support, credential exposure)If you believe this was flagged incorrectly, please let a maintainer know.
github-actions commentedon Jun 7, 2026
This issue has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.
Feel free to open a new issue that follows our issue templates.