kerem commented

Owner

Originally created by @cpuks on GitHub (Oct 7, 2024).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/504

I've got hoarder deployed on my selfhosted server and it's hidden behind Authentik.
I can access and login to hoarder via domain and IP, but I cannot access Hoarder via Android app - it works through IP:port but not via domain.
Tried with API tried with email/passwd nothing works.

Originally created by @cpuks on GitHub (Oct 7, 2024). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/504 I've got hoarder deployed on my selfhosted server and it's hidden behind Authentik. I can access and login to hoarder via domain and IP, but I cannot access Hoarder via Android app - it works through IP:port but not via domain. Tried with API tried with email/passwd nothing works. ![Screenshot_20241007-152338](https://github.com/user-attachments/assets/3d808ab2-08de-4653-bd7c-df42ac446030) ![Screenshot_20241007-155610](https://github.com/user-attachments/assets/4b4a15b4-5e8c-49cd-89bb-bb01e797a2e3)

kerem

2026-03-02 11:48:51 +03:00

closed this issue
added the
question
label

kerem commented

2026-03-02 11:48:52 +03:00

Author

Owner

@kamtschatka commented on GitHub (Oct 7, 2024):

"Unexpected character: <" means in 99,99999% of the cases, that this is not getting a JSON response, but HTML.
My guess is, since you said "it's hidden behind Authentik", that you have set it up wrong.
To me that sounds like you are using a Proxy authenticator in authentik, which is not supported. You have to use the OAuth2/OpenID provider.

@kamtschatka commented on GitHub (Oct 7, 2024): "Unexpected character: <" means in 99,99999% of the cases, that this is not getting a JSON response, but HTML. My guess is, since you said "it's hidden behind Authentik", that you have set it up wrong. To me that sounds like you are using a Proxy authenticator in authentik, which is not supported. You have to use the OAuth2/OpenID provider.

kerem commented

2026-03-02 11:48:52 +03:00

Author

Owner

@cpuks commented on GitHub (Oct 7, 2024):

I've got OAuth2 provided ready but... I cannot get this option to work:

And my .env part of OAUTH
OAUTH_WELLKNOWN_URL=<redacted> OAUTH_CLIENT_SECRET=<redacted> OAUTH_CLIENT_ID=<redacted> OAUTH_SCOPE=openid email profile OAUTH_PROVIDER_NAME=Authentik OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=true
With those env set I should see OAuth login but it's not there - tried different browsers

@cpuks commented on GitHub (Oct 7, 2024): I've got OAuth2 provided ready but... I cannot get this option to work: ![{C4C1417B-A08C-4FE4-9AEE-CDA6B84067D4}](https://github.com/user-attachments/assets/28b078a9-447d-4f12-a9f3-0626271d8bad) And my .env part of OAUTH ` OAUTH_WELLKNOWN_URL=<redacted> OAUTH_CLIENT_SECRET=<redacted> OAUTH_CLIENT_ID=<redacted> OAUTH_SCOPE=openid email profile OAUTH_PROVIDER_NAME=Authentik OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=true ` With those env set I should see OAuth login but it's not there - tried different browsers

kerem commented

2026-03-02 11:48:52 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Oct 7, 2024):

@cpuks this usually indicates problems in your NEXTAUTH_URL. Do you see errors like this one in the logs of the web container?

@MohamedBassem commented on GitHub (Oct 7, 2024): @cpuks this usually indicates problems in your `NEXTAUTH_URL`. Do you see errors like this one in the logs of the web container? <img width="580" alt="Screenshot 2024-10-07 at 11 43 58 PM" src="https://github.com/user-attachments/assets/30767bf5-0f8a-4c7e-b09b-788caed72982">

kerem commented

2026-03-02 11:48:52 +03:00

Author

Owner

@cpuks commented on GitHub (Oct 8, 2024):

That's my error:

And NEXTAUTH_URL=https://hoarder.<domain>
But the problem is that with all those envs I should at least see option to authenticate with OAuth

@cpuks commented on GitHub (Oct 8, 2024): That's my error: ![image](https://github.com/user-attachments/assets/e2e22333-806f-4d67-bf1b-fff43401d53f) And `NEXTAUTH_URL=https://hoarder.<domain>` But the problem is that with all those envs I should at least see option to authenticate with OAuth

kerem commented

2026-03-02 11:48:52 +03:00

Author

Owner

@kamtschatka commented on GitHub (Oct 13, 2024):

yeah so that is exactly what I said. You are hitting a webpage and not an API endpoint.
Did you set up authentik with a proxy provider or with an OAuth provider? Hint: proxy provider does NOT work, as it will redirect everything to authentik first.

@kamtschatka commented on GitHub (Oct 13, 2024): yeah so that is exactly what I said. You are hitting a webpage and not an API endpoint. Did you set up authentik with a proxy provider or with an OAuth provider? Hint: proxy provider does NOT work, as it will redirect everything to authentik first.

kerem commented

2026-03-02 11:48:52 +03:00

Author

Owner

@cpuks commented on GitHub (Oct 13, 2024):

Thanks for reply as I went back to digg that issue - seems like Tailscale is problem, let me explain:
I've got tailscale setup as I don't need to expsoe services to the Internet, then to authenticate my selfhosted app I'm using Authentik with OAuth were possible or ACLs, my rev proxy is NPM, all those serivices are on different containers / PVEs but all of them are logged to my tailscale network so I can use OAuth - immich / audiobookshelf / paperless-ngx and so on are working fine.
With Hoarder only way I finally can see and login via OAuth was:
NEXTAUTH_URL=http://192.168.88.200:3111 Authentik redirect URI: .*
Anytime I set NEXTAUTH_URL to domain name it throws error and never displays Login with OAuth option - probably because that domain is on wildcard and not exposed to the Internet, but for expample Immich on this very same machine just different container works fine.
Any way to make work around other than making my domain public?

EDIT

And Hoarder Android APP throws same error and there's no OAuth login option - just API or email/passwd, but in browser I authenticate with OAuth and redirects me to NEXAUTH_URL

@cpuks commented on GitHub (Oct 13, 2024): Thanks for reply as I went back to digg that issue - seems like Tailscale is problem, let me explain: I've got tailscale setup as I don't need to expsoe services to the Internet, then to authenticate my selfhosted app I'm using Authentik with OAuth were possible or ACLs, my rev proxy is NPM, all those serivices are on different containers / PVEs but all of them are logged to my tailscale network so I can use OAuth - immich / audiobookshelf / paperless-ngx and so on are working fine. With Hoarder only way I finally can see and login via OAuth was: ` NEXTAUTH_URL=http://192.168.88.200:3111 Authentik redirect URI: .* ` Anytime I set NEXTAUTH_URL to domain name it throws error and never displays Login with OAuth option - probably because that domain is on wildcard and not exposed to the Internet, but for expample Immich on this very same machine just different container works fine. Any way to make work around other than making my domain public? ## EDIT And Hoarder Android APP throws same error and there's no OAuth login option - just API or email/passwd, but in browser I authenticate with OAuth and redirects me to NEXAUTH_URL

kerem commented

2026-03-02 11:48:52 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Oct 13, 2024):

@cpuks basically the problem that you're facing is that the URL that you pass in NEXTAUTH_URL needs to be both accessible from the browser, and from inside the container. To get around this, I think you can use:

NEXTAUTH_URL_INTERNAL=http://localhost:3000
NEXTAUTH_URL=<your domain name>
Authentik redirect URI: `<HOARDER_ADDRESS>/api/auth/callback/custom`

Can you give that a shot and let me know if it'd work?

@MohamedBassem commented on GitHub (Oct 13, 2024): @cpuks basically the problem that you're facing is that the URL that you pass in `NEXTAUTH_URL` needs to be both accessible from the browser, and from inside the container. To get around this, I think you can use: ``` NEXTAUTH_URL_INTERNAL=http://localhost:3000 NEXTAUTH_URL=<your domain name> Authentik redirect URI: `<HOARDER_ADDRESS>/api/auth/callback/custom` ``` Can you give that a shot and let me know if it'd work?

kerem commented

2026-03-02 11:48:52 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Oct 13, 2024):

The main thing that there's no way around is that whatever address that you put in the OUTH well known address it needs to be "reachable/resolvable" from within the hoarder container. Hoarder's backend needs to be able to talk to authentik.

@MohamedBassem commented on GitHub (Oct 13, 2024): The main thing that there's no way around is that whatever address that you put in the OUTH well known address it needs to be "reachable/resolvable" from within the hoarder container. Hoarder's backend needs to be able to talk to authentik.

kerem commented

2026-03-02 11:48:52 +03:00

Author

Owner

@cpuks commented on GitHub (Oct 13, 2024):

@MohamedBassem perfect thanks that worked in browser but not in Android app - maybe that NEXAUTH_URL_INTERNAL should be added to docs?

@cpuks commented on GitHub (Oct 13, 2024): @MohamedBassem perfect thanks that worked in browser but not in Android app - maybe that NEXAUTH_URL_INTERNAL should be added to docs?

kerem commented

2026-03-02 11:48:52 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Oct 13, 2024):

@cpuks I think I can include it in the docker container itself so that people won't need to touch it themselves.

Now for the android app, is your app still "behind" authentic or did you ditch that setup and just using OAUTH now?

@MohamedBassem commented on GitHub (Oct 13, 2024): @cpuks I think I can include it in the docker container itself so that people won't need to touch it themselves. Now for the android app, is your app still "behind" authentic or did you ditch that setup and just using OAUTH now?

kerem commented

2026-03-02 11:48:53 +03:00

Author

Owner

@cpuks commented on GitHub (Oct 13, 2024):

Just reinstalled Android app - when I type domain address it gives me only option to login with email/passwd or API - like on 1st post, no OAuth option.

EDIT

Just tested on iPadOS and Edge incognito (Win11) and browser works fine - OAuth redirects to https domain, just app is problematic.

@cpuks commented on GitHub (Oct 13, 2024): Just reinstalled Android app - when I type domain address it gives me only option to login with email/passwd or API - like on 1st post, no OAuth option. # EDIT Just tested on iPadOS and Edge incognito (Win11) and browser works fine - OAuth redirects to https domain, just app is problematic.

kerem commented

2026-03-02 11:48:53 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Oct 13, 2024):

@cpuks when using Oauth, you should be using API keys for authentication.

@MohamedBassem commented on GitHub (Oct 13, 2024): @cpuks when using Oauth, you should be using API keys for authentication.

kerem commented

2026-03-02 11:48:53 +03:00

Author

Owner

@cpuks commented on GitHub (Oct 13, 2024):

That's same error with API - JSON parse error - as in first post, I'm logged fine in browser on that very same phone, URL is accessible.

@cpuks commented on GitHub (Oct 13, 2024): That's same error with API - JSON parse error - as in first post, I'm logged fine in browser on that very same phone, URL is accessible.

kerem commented

2026-03-02 11:48:53 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Oct 13, 2024):

@cpuks Basically this means that something is infront of hoarder responding with html content instead of JSON. If Hoarder is still behind "hidden" behind authentik then that's the problem.

I've also pushed github.com/hoarder-app/hoarder@90953fdab8 which will fix connection testing to debug the error you're facing. Hopefully it'll be released by google in a day and two and would help us debug this further.

@MohamedBassem commented on GitHub (Oct 13, 2024): @cpuks Basically this means that something is infront of hoarder responding with html content instead of JSON. If Hoarder is still behind "hidden" behind authentik then that's the problem. I've also pushed https://github.com/hoarder-app/hoarder/commit/90953fdab873077c0ba5f233906703c0f5d7b14b which will fix connection testing to debug the error you're facing. Hopefully it'll be released by google in a day and two and would help us debug this further.

kerem commented

2026-03-02 11:48:53 +03:00

Author

Owner

@cpuks commented on GitHub (Oct 13, 2024):

Perfect - I'll get back once it'll be available. Thanks a lot for help so far.

@cpuks commented on GitHub (Oct 13, 2024): Perfect - I'll get back once it'll be available. Thanks a lot for help so far.

kerem commented

2026-03-02 11:48:53 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Oct 13, 2024):

@cpuks the update is now on the play store

@MohamedBassem commented on GitHub (Oct 13, 2024): @cpuks the update is now on the play store

kerem commented

2026-03-02 11:48:53 +03:00

Author

Owner

@cpuks commented on GitHub (Oct 14, 2024):

That's the error:

Running connection test ...

Using address: https://hoarder.<redacted>

Failed to parse response as JSON: SyntaxError: JSON Parse error: Unexpected character: <

Got the following response:





<!DOCTYPE html>

<html>
    <head>
        <meta charset="UTF-8">
        <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
        <title>authentik</title>
        <link rel="icon" href="/static/dist/assets/icons/icon.png">
        <link rel="shortcut icon" href="/static/dist/assets/icons/icon.png">
        

        
<link rel="prefetch" href="/static/dist/assets/images/flow_background.jpg" />




<script>
    window.authentik = {
        locale: "en-us",
        config: JSON.parse('{\u0022error_reporting\u0022: {\u0022enabled\u0022: true, \u0022sentry_dsn\u0022: \u0022https://151ba72610234c4c97c5bcff4e1cffd8@authentik.error\[u002Dreporting.a7k.io/4504163677503489](http://u002dreporting.a7k.io/4504163677503489)\u0022, \u0022environment\u0022: \u0022customer\u0022, \u0022send_pii\u0022: false, \u0022traces_sample_rate\u0022: 0.1}, \u0022capabilities\u0022: [\u0022can_save_media\u0022, \u0022can_asn\u0022, \u0022can_geo_ip\u0022, \u0022can_impersonate\u0022, \u0022is_enterprise\u0022], \u0022cache_timeout\u0022: 300, \u0022cache_timeout_flows\u0022: 300, \u0022cache_timeout_policies\u0022: 300, \u0022cache_timeout_reputation\u0022: 0}'),
        brand: JSON.parse('{\u0022matched_domain\u0022: \u0022authentik\u002Ddefault\u0022, \u0022branding_title\u0022: \u0022authentik\u0022, \u0022branding_logo\u0022: \u0022/static/dist/assets/icons/icon_left_brand.svg\u0022, \u0022branding_favicon\u0022: \u0022/static/dist/assets/icons/icon.png\u0022, \u0022ui_footer_links\u0022: [], \u0022ui_theme\u0022: \u0022automatic\u0022, \u0022flow_authentication\u0022: \u0022default\u002Dauthentication\u002Dflow\u0022, \u0022flow_invalidation\u0022: \u0022default\u002Dinvalidation\u002Dflow\u0022, \u0022flow_user_settings\u0022: \u0022default\u002Duser\u002Dsettings\u002Dflow\u0022, \u0022default_locale\u0022: \u0022\u0022}'),
        versionFamily: "2024.10",
        versionSubdomain: "version-2024-10",
        build: "",
    };
    window.addEventListener("DOMContentLoaded", function () {
        
    });
</script>

<script>
window.authentik.flow = {
    "layout": "stacked",
};
</script>

        <link rel="stylesheet" type="text/css" href="/static/dist/authentik.css">
        <link rel="stylesheet" type="text/css" href="/static/dist/custom.css" data-inject>
        <script src="/static/dist/poly-2024.10.1.js" type="module"></script>
        <script src="/static/dist/standalone/loading/index-2024.10.1.js" type="module"></script>
        
<script src="/static/dist/flow/FlowInterface-2024.10.1.js" type="module"></script>
<style>
:root {
    --ak-flow-background: url("/static/dist/assets/images/flow_background.jpg");
}
</style>

        <meta name="sentry-trace" content="4d102e1cee7e4b72b169a9c6d206a180-aac12415c85a5040-1" />
    </head>
    <body>
        
<ak-message-container></ak-message-container>
<ak-flow-executor flowSlug="default-authentication-flow">
    <ak-loading></ak-loading>
</ak-flow-executor>

        
        
    </body>
</html>

@cpuks commented on GitHub (Oct 14, 2024): That's the error: ``` Running connection test ... Using address: https://hoarder.<redacted> Failed to parse response as JSON: SyntaxError: JSON Parse error: Unexpected character: < Got the following response: <!DOCTYPE html> <html> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"> <title>authentik</title> <link rel="icon" href="/static/dist/assets/icons/icon.png"> <link rel="shortcut icon" href="/static/dist/assets/icons/icon.png"> <link rel="prefetch" href="/static/dist/assets/images/flow_background.jpg" /> <script> window.authentik = { locale: "en-us", config: JSON.parse('{\u0022error_reporting\u0022: {\u0022enabled\u0022: true, \u0022sentry_dsn\u0022: \u0022https://151ba72610234c4c97c5bcff4e1cffd8@authentik.error\[u002Dreporting.a7k.io/4504163677503489](http://u002dreporting.a7k.io/4504163677503489)\u0022, \u0022environment\u0022: \u0022customer\u0022, \u0022send_pii\u0022: false, \u0022traces_sample_rate\u0022: 0.1}, \u0022capabilities\u0022: [\u0022can_save_media\u0022, \u0022can_asn\u0022, \u0022can_geo_ip\u0022, \u0022can_impersonate\u0022, \u0022is_enterprise\u0022], \u0022cache_timeout\u0022: 300, \u0022cache_timeout_flows\u0022: 300, \u0022cache_timeout_policies\u0022: 300, \u0022cache_timeout_reputation\u0022: 0}'), brand: JSON.parse('{\u0022matched_domain\u0022: \u0022authentik\u002Ddefault\u0022, \u0022branding_title\u0022: \u0022authentik\u0022, \u0022branding_logo\u0022: \u0022/static/dist/assets/icons/icon_left_brand.svg\u0022, \u0022branding_favicon\u0022: \u0022/static/dist/assets/icons/icon.png\u0022, \u0022ui_footer_links\u0022: [], \u0022ui_theme\u0022: \u0022automatic\u0022, \u0022flow_authentication\u0022: \u0022default\u002Dauthentication\u002Dflow\u0022, \u0022flow_invalidation\u0022: \u0022default\u002Dinvalidation\u002Dflow\u0022, \u0022flow_user_settings\u0022: \u0022default\u002Duser\u002Dsettings\u002Dflow\u0022, \u0022default_locale\u0022: \u0022\u0022}'), versionFamily: "2024.10", versionSubdomain: "version-2024-10", build: "", }; window.addEventListener("DOMContentLoaded", function () { }); </script> <script> window.authentik.flow = { "layout": "stacked", }; </script> <link rel="stylesheet" type="text/css" href="/static/dist/authentik.css"> <link rel="stylesheet" type="text/css" href="/static/dist/custom.css" data-inject> <script src="/static/dist/poly-2024.10.1.js" type="module"></script> <script src="/static/dist/standalone/loading/index-2024.10.1.js" type="module"></script> <script src="/static/dist/flow/FlowInterface-2024.10.1.js" type="module"></script> <style> :root { --ak-flow-background: url("/static/dist/assets/images/flow_background.jpg"); } </style> <meta name="sentry-trace" content="4d102e1cee7e4b72b169a9c6d206a180-aac12415c85a5040-1" /> </head> <body> <ak-message-container></ak-message-container> <ak-flow-executor flowSlug="default-authentication-flow"> <ak-loading></ak-loading> </ak-flow-executor> </body> </html> ```

kerem commented

2026-03-02 11:48:53 +03:00

Author

Owner

@cpuks commented on GitHub (Nov 10, 2024):

Any chance that's fixable or I should leave hope and use Hoarder via browser?

@cpuks commented on GitHub (Nov 10, 2024): Any chance that's fixable or I should leave hope and use Hoarder via browser?

kerem commented

2026-03-02 11:48:53 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Nov 10, 2024):

@cpuks sorry I missed your message. The debug logs basically shows authentik responding not hoarder. This is currently not supported. You'll need to not put Authentik in front of hoarder and the mobile app would work. You can still use authentik for oauth (and disable password logins), but you just can't use authentik for forward auth.

@MohamedBassem commented on GitHub (Nov 10, 2024): @cpuks sorry I missed your message. The debug logs basically shows authentik responding not hoarder. This is currently not supported. You'll need to not put Authentik in front of hoarder and the mobile app would work. You can still use authentik for oauth (and disable password logins), but you just can't use authentik for forward auth.

kerem commented

2026-03-02 11:48:53 +03:00

Author

Owner

@cpuks commented on GitHub (Nov 10, 2024):

Ok so I'll just set rev proxy straight to Hoarder and close the issue.

@cpuks commented on GitHub (Nov 10, 2024): Ok so I'll just set rev proxy straight to Hoarder and close the issue.

kerem commented

2026-03-02 11:48:53 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Nov 10, 2024):

yeah give it a shot and let me know how it goes. I'm planning to add custom headers support to mobile logins but I still haven't got a chance to do it.

Your other option is to exclude the '/api/*' routes from authentik's forward proxy.

@MohamedBassem commented on GitHub (Nov 10, 2024): yeah give it a shot and let me know how it goes. I'm planning to add custom headers support to mobile logins but I still haven't got a chance to do it. Your other option is to exclude the '/api/*' routes from authentik's forward proxy.

kerem commented

2026-03-02 11:48:53 +03:00

Author

Owner

@Kavinraja-G commented on GitHub (Nov 16, 2025):

Noting it here for who got stumbled on this issue when using Pangolin Auth on the resources. Once I disabled the platform authentication in Pangolin - extensions, app everything works fine.

I'd like to see how we can resolve this, @MohamedBassem any thoughts? Thanks!

@Kavinraja-G commented on GitHub (Nov 16, 2025): Noting it here for who got stumbled on this issue when using Pangolin Auth on the resources. Once I disabled the platform authentication in Pangolin - extensions, app everything works fine. I'd like to see how we can resolve this, @MohamedBassem any thoughts? Thanks!

kerem commented

2026-03-02 11:48:54 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Nov 16, 2025):

@Kavinraja-G you need to allowlist the api endpoints used by karakeep (https://docs.pangolin.net/manage/access-control/rules). The other option is to use the newly released custom header feature in karakeep to authenticate to pangolin

@MohamedBassem commented on GitHub (Nov 16, 2025): @Kavinraja-G you need to allowlist the api endpoints used by karakeep (https://docs.pangolin.net/manage/access-control/rules). The other option is to use the newly released custom header feature in karakeep to authenticate to pangolin

Rows
Columns

[GH-ISSUE #504] Android app error #326

EDIT

EDIT