Repository navigation
[FEATURE]: make OAUTH_CALLBACK_HOST configurable #33966
Description
Feature hasn't been suggested before.
- I have verified this feature I'm about to request hasn't been suggested before.
Describe the enhancement you want to request
#30022 recently changed the oauth server to bind to 127.0.0.1 only.
I use opencode inside a container, and was using docker run -p 19876 to get the browser on my host talking to opencode via http://127.0.0.1:19876.
I would like a new envvar or config option to customize OAUTH_CALLBACK_HOST.
workaround
Use a docker entrypoint with socat to route traffic
#!/usr/bin/env bash
socat TCP-LISTEN:19877,fork,bind=0.0.0.0 TCP:127.0.0.1:19876 &
opencode "$@"When I need to authenticate, I run docker run -p 19876:19877 --entrypoint=..., with routes the traffic correctly:
flowchart
subgraph host
browser
docker
subgraph container
socat
opencode
end
end
browser -->|127.0.0.1:19876| docker
docker -->|0.0.0.0:19877| socat
socat -->|127.0.0.1:19876| opencode
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Jun 25, 2026
This issue might be a duplicate of existing issues. Please check:
opencode webbehind a reverse proxy: OAuth callbacks should use the external URL, notlocalhost:1455#24455: Same root problem — OAuth callback host/URL is not configurable, making OAuth flows fail in container/reverse-proxy deployments where the listener binds only to127.0.0.1.ryepup commentedon Jun 25, 2026
This is a different oauth flow than #24455, I think it's a separate issue.
wp07e commentedon Jul 5, 2026
Thank you! Been struggling with this the entire day. I'll use your work around for now.
magnuslarsen commentedon Jul 6, 2026
I too would like to see this fixed. I have a remote server where I run OpenCode, and authenticate via my laptop. This broke with the hardcoded 127.0.0.1 host
dannykopping commentedon Aug 12, 2026
It's becoming more and more essential to run AI agents inside of sandboxes, and listening only on localhost prevents that from being done easily, since the locally-bound port can't be addressed from the outside during the OAuth callback.
ryepup commentedon Aug 14, 2026
I can think of two ways to solve this:
const OAUTH_CALLBACK_HOST = process.env.OPENCODE_OAUTH_CALLBACK_HOST || "127.0.0.1";- no other config works this waypackages/opencode/src/mcp/oauth-callback.ts. In this case my best guess is an optional "host" arg toMcpOAuthCallback.ensureRunning, and expand theOauthschema to have an optionalcallbackHostnext tocallbackPort. We'd want to add bothcallback*options to https://opencode.ai/docs/mcp-servers#oauth-options.tstraley commentedon Oct 14, 2026
This type of issue could also be solved with headless (paste-code) oauth solution, as brought up in #54495
opencodejr commentedon Oct 29, 2026
Thanks for the request and for writing up the
socatworkaround, @ryepup!To restate it: you'd like a config option or environment variable to set the host the MCP OAuth callback listener binds to. When OpenCode runs in a container, sandbox or on a remote host, the browser could then reach the callback through a published port. Since #30022 the listener is bound to
127.0.0.1only. The current v2 code (packages/core/src/mcp/oauth.ts) also hardcodes127.0.0.1, and onlycallback_portandredirect_urican be configured. Maintainers will consider it.Related issues and PRs:
oauth.callbackHostoption for this. It was never merged.Until then, your
socatentrypoint (or SSH port forwarding for remote hosts) is the way to go.