Repository navigation
v2 serve: configured Basic Auth credentials always return 401 #45856
Description
Summary
opencode2 serve rejects the exact HTTP Basic Auth username and password supplied through OPENCODE_SERVER_USERNAME and OPENCODE_SERVER_PASSWORD. In a browser, this causes an endless login prompt and prevents using serve with fixed credentials.
Environment
- opencode version:
opencode2 v0.0.0-beta-18414 - OS:
Linux 7.0.0-30-generic x86_64(Ubuntu) - Terminal:
TERM=xterm-256color,COLORTERM=truecolor, Herdr terminal environment - Shell:
/bin/bash - Install/channel: beta binary installed at
~/.opencode/bin/opencode2 - Active plugins: local
.opencode/plugins/smoke-theme.jsonand.opencode/plugins/tui-smoke.tsx; no plugins configured in the global config
Reproduction
-
Start a fresh server with known credentials:
OPENCODE_SERVER_USERNAME=testuser OPENCODE_SERVER_PASSWORD=testpass opencode2 serve --port 4197
-
Confirm that both variables are present in the running server process.
-
Request the health endpoint with those exact credentials:
curl -u testuser:testpass http://127.0.0.1:4197/api/health
-
Open
http://127.0.0.1:4197in a browser and enter the same credentials.
Expected Behavior
The configured credentials authenticate successfully, the health request returns 200, and the web UI loads after one login prompt.
Actual Behavior
The authenticated health request returns 401. The server log records repeated responses such as:
http.method=GET http.url=/api/health http.status=401
http.method=GET http.url=/ http.status=401
The browser keeps showing the Basic Auth login prompt after the correct credentials are entered.
Additional Context
- Reproduces consistently with a clean temporary server and known test credentials.
- The exact credentials read from the running process environment also return
401, ruling out shell quoting and browser credential caching. opencode2 paircredentials authenticate successfully against the managed background service, but they do not authenticate against the explicitserveendpoint.- The managed-service pairing workflow is not equivalent to running a stable
serveendpoint with user-selected credentials. - No secrets or real credentials are included above.
Activity
OpeOginni commentedon Aug 28, 2026
seems like currently for v2, the username is stuck at "opencode" and you cant override it
Sailendrakc commentedon Sep 23, 2026
Yes. But thanks for pointing out the username.
Merlin-Clos commentedon Sep 23, 2026
I confirm with
OPENCODE_SERVER_USERNAME=testuser OPENCODE_SERVER_PASSWORD=testpass opencode servethat I'm able to log in using the usernameopencodeand the passwordtestpassfmoutella commentedon Sep 28, 2026
I also confirm this behavior in v2.0.18. Docs are misleading.
Username is hardcoded as "opencode" in opencode/packages/server/src/auth.ts, and does not refer to any config (json or env) as Password does:
export class Config extends Context.Service<Config, Info>()("@opencode/ServerAuthConfig") {
static configLayer(input: Pick<Info, "password">) {
return Layer.succeed(this, this.of({ ...input, username: "
opencode" }))}
static get layer() {
return this.configLayer({ password: Option.none() })
}
}
Mattheinrichs commentedon Oct 8, 2026
Client-side counterpart of this, still present on v2.0.6 and v2.0.26 tagged sources:
opencode --server <url>hardcodes the Basic username toopencodeand never readsOPENCODE_SERVER_USERNAME.packages/cli/src/services/server-connection.ts:28—auth: password ? { type: "basic", username: "opencode", password: Redacted.value(password) } : undefinedpackages/cli/src/env.ts:10— only the password is exposed (OPENCODE_PASSWORD, falling back to legacyOPENCODE_SERVER_PASSWORD); there is no username env var.So even on builds where the server honors
OPENCODE_SERVER_USERNAME(currentdevreads it again), a remote client cannot present a non-default username.Repro (v2.0.6 binary, isolated HOME):
OPENCODE_SERVER_USERNAME=alice OPENCODE_SERVER_PASSWORD=secret opencode serve --hostname 127.0.0.1 --port 4097OPENCODE_SERVER_PASSWORD=secret opencode session list --server http://127.0.0.1:4097GET /agent?directory=... -> 401 Unauthorized: (empty response body)); succeeds when the server runs with the default username.Suggested fix: expose
OPENCODE_SERVER_USERNAME(defaultopencode) inpackages/cli/src/env.tsand use it inserver-connection.tsinstead of the literal.Workaround for anyone hitting this today: name the account
opencodeon the server (and, if behind a forward-auth proxy validating the same Basic header, on that too).alex-mashin commentedon Oct 25, 2026
This issue seems rather urgent. For someone, who hasn't come across this issue and read that the username is hardcoded to
opencode,opencode serveis effectively broken.Mattheinrichs commentedon Oct 26, 2026
Confirmed on v2.0.32: the server ignores OPENCODE_SERVER_USERNAME and only accepts
opencode, and the CLI client also hardcodesopencodefor--server(the managed-service registration only carries the password). V1 read the env var in packages/opencode/src/server/auth.ts, so this is a V2 regression against the documented behaviour.Proposed fix, default unchanged: honour OPENCODE_SERVER_USERNAME end-to-end.
--server, standalone, and managed-service registration/probeThis has been assigned to @neriousy since 2026-08-28, a minute after it was opened, with no linked branch or PR. Not trying to duplicate that work: happy to defer if you're already on it, or open a draft PR if not.
If V2 intends the username to stay fixed at
opencode, say so and I will turn this into a docs fix instead.opencode-agent commentedon Oct 27, 2026
Decision: the V2 server's Basic auth username is hardcoded to
opencodeand will not be configurable.OPENCODE_SERVER_USERNAMEis intentionally unsupported in V2, so #59379 (which re-added it) is being reverted in #59444.In V2, set only the password and use the username
opencode:OPENCODE_SERVER_PASSWORDstill works as a legacy name. #59444 also updates the docs to describe this and to note the change in the V1 migration guide.alex-mashin commentedon Oct 27, 2026
Could a human confirm that hardcoding the user name to
ooencodewas intentional, and the revert justified?