Repository navigation
tui: openai oauth redirects to localhost callback on remote servers #58095
Description
Summary
OpenAI (ChatGPT OAuth) authorization in the TUI is broken when opencode is connected to a remote server. After completing the browser authorization flow, the browser is redirected to http://127.0.0.1:39833/auth/callback?code=... instead of the remote server's callback URL, so the remote opencode instance never receives the authorization code. The same problem affects the web UI.
Environment
- opencode version: v2.1.2
- OS: Linux 5.14.0-687.59.1.el9_8.x86_64 (linux x64)
- Terminal: xterm-256color
- Shell: /bin/bash
- Install/channel: latest (release)
- Active plugins: None found in config
- Remote server: an opencode server reached via
opencode --server <url>(TUI attach); web UI also affected - Browser: runs on the local client machine, not the remote server
Reproduction
- Start or connect to a remote opencode server (e.g.
opencode --server <remote-opencode-server-url>). - In the TUI (or web UI), run
/connectand choose the OpenAI provider (ChatGPT OAuth). - Complete authorization in the browser on the local machine.
- Observe the browser redirect to
http://127.0.0.1:39833/auth/callback?code=ac_Gmk5...instead of the remote server callback. - The remote opencode instance never receives the code; authorization does not complete.
Expected Behavior
The OAuth callback should be handled by the remote server (or a flow usable from a remote client), so authorization completes for remote sessions. At minimum, the redirect URI should not be hardcoded to 127.0.0.1 when the client is connected to a remote server.
Actual Behavior
Browser is redirected to http://127.0.0.1:39833/auth/callback?code=..., which is unreachable/useless from the remote-server context, and the authorization never completes. Reproduces every time.
Additional Context
- Auth method: OpenAI / ChatGPT browser OAuth.
- No server logs or TUI error output beyond
/connect; not sure whether auth attempts are logged. - Workaround attempted: changing the callback URL (did not resolve).
- Frequency: consistent (every attempt).
- Recent changes: none reported.
Activity
opencode-agent commentedon Oct 22, 2026
Thanks for the detailed report!
If I understand right, you'd like ChatGPT sign-in (
/connect→ OpenAI) to work when the TUI or web UI is connected to a remote opencode server, with the browser on your local machine.Right now, "Sign in with ChatGPT" starts a small listener on the server at
127.0.0.1on a random port and asks OpenAI to send the browser back there. That only works when the browser and the server are on the same machine, so on a remote server the code never reaches it. Supporting remote clients would need a new flow, such as handling the callback on the remote server or letting you paste the code or redirect URL back in. I've filed this as a feature request for the maintainers to consider.In the meantime, the "Codex device code (legacy)" method under OpenAI doesn't use a browser callback, so it should work from a remote client.
Related issues:
opencode webbehind a reverse proxy: OAuth callbacks should use the external URL, notlocalhost:1455#24455: a request to have OAuth callbacks use the server's external URL behind a reverse proxy (closed)