Repository navigation
v2.0.5: opencode serve returns 401 when server auth env vars are unset or empty #49452
Closed as duplicate
Description
Description
On v2.0.5, opencode serve returns HTTP 401 for a loopback-only server even when both OPENCODE_SERVER_PASSWORD and OPENCODE_SERVER_USERNAME are absent or explicitly empty in a clean HOME/XDG environment. The server logs an auto-generated password. Please clarify whether this is intentional and, if so, how to disable it; otherwise, please treat it as a regression.
Plugins
None.
OpenCode version
v2.0.5 (official opencode upgrade 2.0.5 --method curl).
Steps to reproduce
probe_root=$(mktemp -d); mkdir -p "$probe_root"/{config,data,state,cache,home}- Run:
env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOME="$probe_root/home" XDG_CONFIG_HOME="$probe_root/config" XDG_DATA_HOME="$probe_root/data" XDG_STATE_HOME="$probe_root/state" XDG_CACHE_HOME="$probe_root/cache" opencode serve --hostname 127.0.0.1 --port 4097 --print-logs - In another terminal:
curl -i http://127.0.0.1:4097/global/health - Stop the server; repeat step 2 with
OPENCODE_SERVER_PASSWORD="" OPENCODE_SERVER_USERNAME=""added.
Expected: clarify whether auth should be disabled with variables absent/empty, and provide an opt-out if auth is intentional.
Actual: both variants log an auto-generated password and return 401.
Screenshot and/or share link
None. Do not paste the generated password.
Operating System
Ubuntu 26.04.1 LTS
Terminal
zsh 5.9
Reacted by Stefan Weitzel and Hugo TOMASI
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Sep 17, 2026
This issue might be a duplicate of existing issues. Please check:
v2 serve: configured Basic Auth credentials always return 401— same v2opencode servereturning 401, related to Basic Auth being active by default/misconfiguredopencode serve requires HTTP auth, breaking SDK / third-party clients(closed) — same root complaint about auth being required onservewith no documented opt-outcli: TUI fails to connect to password-protected explicit server via --server— closely related: password-protected serve failing to authenticate in v2.0.5running1017 commentedon Sep 17, 2026
I checked the duplicate suggestions. #45856 concerns operator-supplied Basic credentials being rejected. #31254 is more closely related: it reports always-on/non-discoverable server authentication in an earlier release. This report adds a clean v2.0.5 reproduction showing 401 when the auth variables are omitted or explicitly empty.
neriousy commentedon Oct 20, 2026
Thanks for the clean-environment reproduction — this is the same always-on server authentication problem as #43039, and we're tracking the opt-out request there. Please subscribe or add your omitted-versus-empty environment-variable results to that issue; those checks are useful supporting details.