Failing to authenticate into web UI when username or password is set

[thdxg]

Description

I set the environment variables OPENCODE_SERVER_USERNAME and OPENCODE_SERVER_PASSWORD, and then started a web UI using the opencode web command. However, when I open the server URL on browser, the authentication dialog keeps opening up even when I put correct username and password.

The server logs just say failed, and the subsequent run of opencode fails with an error saying Unauthorized.

If I unset the environment variables, opencode works again.

Plugins

No response

OpenCode version

1.1.21

Steps to reproduce

1. Set OPENCODE_SERVER_USERNAME and OPENCODE_SERVER_PASSWORD environment variables
2. Run opencode web --> cannot authenticate with the correct username and password
3. Run opencode --> fails with an error Unauthorized
4. Unset OPENCODE_SERVER_USERNAME and OPENCODE_SERVER_PASSWORD
5. opencode works again

Screenshot and/or share link

Operating System

macOS 26.3

Terminal

Ghostty

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• fix: Plugin client returns 401 Unauthorized when OPENCODE_SERVER_PASSWORD is set (Desktop) #8676: Plugin client returns 401 Unauthorized when OPENCODE_SERVER_PASSWORD is set (Desktop)
• OPENCODE_SERVER_PASSWORD in env prevents user from working in TUI #8173: OPENCODE_SERVER_PASSWORD in env prevents user from working in TUI
• Cannot 'attach' to an opencode server with a password #9011: Cannot 'attach' to an opencode server with a password

All three issues relate to authentication failures when OPENCODE_SERVER_PASSWORD environment variable is set, which appears to be a broader problem with how password-protected servers handle client authentication.

Feel free to ignore if your specific case differs from these.

[LeonMueller-OneAndOnly]

This issue is now fixed by PR #9095, which completes the authentication fix started in PR #8179. The new PR addresses the HTTP server authentication path when TUI and server are started alongside with a password.

[github-actions]

To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.

[cristoslc]

Hitting this on 1.4.0 with opencode serve --hostname 0.0.0.0 + browser access. TUI works fine (env vars), but the web UI's JS client doesn't attach credentials to its fetch calls — every API request after page load gets 401. Happy to test any fix.