[GH-ISSUE #490] Issue authenticating through mobile app and browser extention

kerem commented

2026-03-02 11:48:44 +03:00

Owner

Originally created by @SutanuNandigrami on GitHub (Oct 6, 2024).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/490

My server subdomains are behind Authelia for SSO. This is causing problem while authenticating the mobile app or the browser extension. This happens for both User/pass and API key auth.

Any way account login can be redirected to the browser?

Error:


Running connection test ...

Using address: https://hoarder.domain.ltd

Recieve non success error code: 401

Got the following response:

<a href="https://login.domain.ltd/?rd=https%3A%2F%2Fhoarder.domain.ltd%2F&amp;rm=GET">401 Unauthorized</a>

Originally created by @SutanuNandigrami on GitHub (Oct 6, 2024). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/490 My server subdomains are behind Authelia for SSO. This is causing problem while authenticating the mobile app or the browser extension. This happens for both User/pass and API key auth. Any way account login can be redirected to the browser? Error: ``` Running connection test ... Using address: https://hoarder.domain.ltd Recieve non success error code: 401 Got the following response: <a href="https://login.domain.ltd/?rd=https%3A%2F%2Fhoarder.domain.ltd%2F&rm=GET">401 Unauthorized</a> ```

kerem

2026-03-02 11:48:44 +03:00

closed this issue
added the
extension

question

android

ios
labels

kerem commented

2026-03-02 11:48:45 +03:00

Author

Owner

@kamtschatka commented on GitHub (Oct 6, 2024):

A few things:

You can only use the API key with OAuth active, as the API does not support OAuth authentication
The mobile apps currently do not support that, but the browser extension does
Sounds like you have set up Authelia wrong and proxy all the trafic through it(i am assuming login.domain.ltd is your authelia domain). I am not using Authelia, but Authentik, so I can not give exact instructions, but in Authentik there are "OAuth2/OpenID providers", which you have to use for Hoarder. There are also "Proxy Providers", which will have all the trafic run through Authentik, which is NOT the thing you want.
If you set that up correctly, at least the browser extension will work.

@kamtschatka commented on GitHub (Oct 6, 2024): A few things: * You can only use the API key with OAuth active, as the API does not support OAuth authentication * The mobile apps currently do not support that, but the browser extension does * Sounds like you have set up Authelia wrong and proxy all the trafic through it(i am assuming login.domain.ltd is your authelia domain). I am not using Authelia, but Authentik, so I can not give exact instructions, but in Authentik there are "OAuth2/OpenID providers", which you have to use for Hoarder. There are also "Proxy Providers", which will have all the trafic run through Authentik, which is NOT the thing you want. If you set that up correctly, at least the browser extension will work.

kerem commented

2026-03-02 11:48:46 +03:00

Author

Owner

@kamtschatka commented on GitHub (Oct 13, 2024):

closing as there was no response. We can reopen if there is a response

@kamtschatka commented on GitHub (Oct 13, 2024): closing as there was no response. We can reopen if there is a response

kerem commented

2026-03-02 11:48:46 +03:00

Author

Owner

@MrAn0nym commented on GitHub (Mar 25, 2025):

Sounds like you have set up Authelia wrong and proxy all the trafic through it(i am assuming login.domain.ltd is your authelia domain). I am not using Authelia, but Authentik, so I can not give exact instructions, but in Authentik there are "OAuth2/OpenID providers", which you have to use for Hoarder. There are also "Proxy Providers", which will have all the trafic run through Authentik, which is NOT the thing you want.

Dont know if that's the case for op as well, but at least for me having all my self hosted services behind a proxy gives me a sense of security as I have to worry less about those services having potential vulnerabilities.
I however doubt there are any realistic/ideal solutions 🤷

@MrAn0nym commented on GitHub (Mar 25, 2025): > * Sounds like you have set up Authelia wrong and proxy all the trafic through it(i am assuming login.domain.ltd is your authelia domain). I am not using Authelia, but Authentik, so I can not give exact instructions, but in Authentik there are "OAuth2/OpenID providers", which you have to use for Hoarder. There are also "Proxy Providers", which will have all the trafic run through Authentik, which is NOT the thing you want. Dont know if that's the case for op as well, but at least for me having all my self hosted services behind a proxy gives me a sense of security as I have to worry less about those services having potential vulnerabilities. I however doubt there are any realistic/ideal solutions 🤷

kerem commented

2026-03-02 11:48:46 +03:00

Author

Owner

@foolab commented on GitHub (Sep 29, 2025):

Hi,

I also have this issue. I want to keep Karakeep behind authelia. I chose Karakeep over Linkwarden because it can run rootless but this is really a show stopper.

I'd appreciate if you would reconsider :)

@foolab commented on GitHub (Sep 29, 2025): Hi, I also have this issue. I want to keep Karakeep behind authelia. I chose Karakeep over Linkwarden because it can run rootless but this is really a show stopper. I'd appreciate if you would reconsider :)

kerem commented

2026-03-02 11:48:46 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Sep 29, 2025):

Hi,

I also have this issue. I want to keep Karakeep behind authelia. I chose Karakeep over Linkwarden because it can run rootless but this is really a show stopper.

I'd appreciate if you would reconsider :)

not sure what exactly the problem you’re facing, can you open a new discussion thread for the problem you’re facing?

@MohamedBassem commented on GitHub (Sep 29, 2025): > Hi, > > I also have this issue. I want to keep Karakeep behind authelia. I chose Karakeep over Linkwarden because it can run rootless but this is really a show stopper. > > I'd appreciate if you would reconsider :) not sure what exactly the problem you’re facing, can you open a new discussion thread for the problem you’re facing?

kerem commented

2026-03-02 11:48:46 +03:00

Author

Owner

@foolab commented on GitHub (Sep 29, 2025):

It is exactly the same problem as the op posted.

I cannot login using the mobile app because Karakeep is running behind authelia (all requests go through authelia. Not only SSO).

I can still open a new discussion if you feel so but it will be similar to this one.

@foolab commented on GitHub (Sep 29, 2025): It is exactly the same problem as the op posted. I cannot login using the mobile app because Karakeep is running behind authelia (all requests go through authelia. Not only SSO). I can still open a new discussion if you feel so but it will be similar to this one.

kerem commented

2026-03-02 11:48:46 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Sep 29, 2025):

have you considered using authelia as an oidc provider instead as covered with in the authelia docs (https://www.authelia.com/integration/openid-connect/clients/karakeep/)? Also the other escape hatch would be to allowlist the ‘/api/*’ urls to not go through authelia.

@MohamedBassem commented on GitHub (Sep 29, 2025): have you considered using authelia as an oidc provider instead as covered with in the authelia docs (https://www.authelia.com/integration/openid-connect/clients/karakeep/)? Also the other escape hatch would be to allowlist the ‘/api/*’ urls to not go through authelia.

kerem commented

2026-03-02 11:48:46 +03:00

Author

Owner

@foolab commented on GitHub (Sep 29, 2025):

As a developer myself, I do understand your position but as a user, I am not really comfortable exposing an app to the internet.

That is why I was hoping you would reconsider this issue :)

@foolab commented on GitHub (Sep 29, 2025): As a developer myself, I do understand your position but as a user, I am not really comfortable exposing an app to the internet. That is why I was hoping you would reconsider this issue :)

kerem commented

2026-03-02 11:48:46 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Sep 29, 2025):

I don’t have a position on this :) I think it makes sense to support oauth based login, or more likely allowing to pass custom headers in the mobile or the extension, it’s just that I didn’t get to it yet (and it’s not on my planned backlog yet). Would be more than happy to accept PRs for it though

@MohamedBassem commented on GitHub (Sep 29, 2025): I don’t have a position on this :) I think it makes sense to support oauth based login, or more likely allowing to pass custom headers in the mobile or the extension, it’s just that I didn’t get to it yet (and it’s not on my planned backlog yet). Would be more than happy to accept PRs for it though

kerem commented

2026-03-02 11:48:46 +03:00

Author

Owner

@foolab commented on GitHub (Sep 29, 2025):

That is great to hear.

I am not an android expert but I will see if I can cook something. Thank you :)

@foolab commented on GitHub (Sep 29, 2025): That is great to hear. I am not an android expert but I will see if I can cook something. Thank you :)

Rows
Columns

[GH-ISSUE #490] Issue authenticating through mobile app and browser extention #314