fix: Plugin client returns 401 Unauthorized when OPENCODE_SERVER_PASSWORD is set (Desktop)

Bug Description

When running OpenCode via Desktop app, plugins that use client.session.create(), client.session.prompt(), or other HTTP API calls receive 401 Unauthorized errors.

Root Cause

OpenCode Desktop (Tauri) automatically generates a UUID password and sets OPENCODE_SERVER_PASSWORD environment variable when spawning the local server:

packages/desktop/src-tauri/src/lib.rs:416

let password = uuid::Uuid::new_v4().to_string();

packages/desktop/src-tauri/src/lib.rs:159

.env("OPENCODE_SERVER_PASSWORD", password)

This enables the basicAuth middleware in server.ts:

packages/opencode/src/server/server.ts:100-104

const password = Flag.OPENCODE_SERVER_PASSWORD
if (!password) return next()
return basicAuth({ username, password })(c, next)

However, the client created for plugins in plugin/index.ts does not include the corresponding Basic Auth credentials, causing all plugin HTTP requests to fail with 401.

Steps to Reproduce

Install OpenCode Desktop (exe version)
Install a plugin that uses client.session.create() (e.g., @menkan/opencode with sisyphus_task)
Run the plugin tool
Observe 401 Unauthorized error

Proposed Fix

Add Basic Auth headers to the plugin client when OPENCODE_SERVER_PASSWORD is configured:

packages/opencode/src/plugin/index.ts

const authHeaders: Record<string, string> = {}
if (Flag.OPENCODE_SERVER_PASSWORD) {
  const username = Flag.OPENCODE_SERVER_USERNAME ?? "opencode"
  const credentials = Buffer.from(`${username}:${Flag.OPENCODE_SERVER_PASSWORD}`).toString("base64")
  authHeaders["Authorization"] = `Basic ${credentials}`
}

const client = createOpencodeClient({
  baseUrl: "http://localhost:4096",
  fetch: async (...args) => Server.App().fetch(...args),
  headers: Object.keys(authHeaders).length > 0 ? authHeaders : undefined,
})

Workaround

Use CLI version (opencode command) instead of Desktop, as CLI does not set OPENCODE_SERVER_PASSWORD.

Environment

OpenCode Desktop on Windows
Plugin SDK version: 1.1.21

This issue might be a duplicate of existing issues. Please check:

Child sessions created via SDK don't execute prompts (v1.1.15+) #8528: Child sessions created via SDK don't execute prompts (v1.1.15+) - Related to the same basicAuth middleware changes that broke plugin authentication
OPENCODE_SERVER_PASSWORD in env prevents user from working in TUI #8173: OPENCODE_SERVER_PASSWORD in env prevents user from working in TUI - Another authentication issue related to the same environment variable

Feel free to ignore if none of these address your specific case.

I actually also cannot connect to web from TUI if I have the password env variable set in my shell, but not even Desktop. CLI installed on macOS from curl. Version 1.1.21

This issue is being adressed and fixed by the pr #9095

The TUI would fail to send an auth header when it was started alongside a http server. In case a password or non default username is set via env vars, this leads to the 401 - not Authorized error.

it is not fixed. Changed key in account but it still returns the same error

As a temporary workaround when using the SDK, e.g. to write plugins, you can do this (messing with "private" methods):

  const password = process.env.OPENCODE_SERVER_PASSWORD
  if (password) {
    const username = process.env.OPENCODE_SERVER_USERNAME || "opencode"
    const authHeader = "Basic " + btoa(`${username}:${password}`)
    const innerClient = (client as any)._client
    if (innerClient?.interceptors?.request?.use) {
      innerClient.interceptors.request.use((req: Request) => {
        req.headers.set("Authorization", authHeader)
        return req
      })
    }
  }

To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.

Navigation Menu

Repository navigation

fix: Plugin client returns 401 Unauthorized when OPENCODE_SERVER_PASSWORD is set (Desktop) #8676

Bug Description

Root Cause

Steps to Reproduce

Proposed Fix

Workaround

Environment

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

fix: Plugin client returns 401 Unauthorized when OPENCODE_SERVER_PASSWORD is set (Desktop) #8676

Description

Bug Description

Root Cause

Steps to Reproduce

Proposed Fix

Workaround

Environment

Activity

github-actions commented on Jan 15, 2026

hubertlepicki commented on Jan 15, 2026

LeonMueller-OneAndOnly commented on Jan 17, 2026

gerchicov-vg commented on Feb 19, 2026

david-christ commented on Mar 1, 2026

github-actions commented on May 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions