Hmbown/CodeWhale · error

Refusing insecure base URL '{display_base_url}'. Loopback h

Error message

Refusing insecure base URL '{display_base_url}'.

Loopback hosts (localhost, 127.0.0.1, [::1]) are auto-allowed.
For other trusted local hosts (LAN, llama.cpp on a private IP, etc.)
set the env var `{ALLOW_INSECURE_HTTP_ENV}=1` in the shell that runs codewhale and re-run.

Example: `{ALLOW_INSECURE_HTTP_ENV}=1 codewhale` (note the underscores).

What it means

`validate_base_url_security` in the HTTP client refuses plain-HTTP base URLs to prevent API keys being sent unencrypted. Only `http://localhost`, `http://127.0.0.1`, and `http://[::1]` are auto-allowed; any other `http://` host is rejected unless the env var `CODEWHALE_ALLOW_INSECURE_HTTP` (legacy alias `DEEPSEEK_ALLOW_INSECURE_HTTP`) is set to `1` or `true` in the process that runs codewhale, in which case a warning is logged and the URL is accepted.

Source

Thrown at crates/tui/src/client.rs:673

    {
        return Ok(());
    }

    if base_url.starts_with("http://")
        && std::env::var(ALLOW_INSECURE_HTTP_ENV)
            .or_else(|_| std::env::var(LEGACY_ALLOW_INSECURE_HTTP_ENV))
            .ok()
            .as_deref()
            .is_some_and(|v| v == "1" || v.eq_ignore_ascii_case("true"))
    {
        logging::warn(format!(
            "Using insecure HTTP base URL because {ALLOW_INSECURE_HTTP_ENV} is set"
        ));
        return Ok(());
    }

    if base_url.starts_with("http://") {
        anyhow::bail!(
            "Refusing insecure base URL '{display_base_url}'.\n\
             \n\
             Loopback hosts (localhost, 127.0.0.1, [::1]) are auto-allowed.\n\
             For other trusted local hosts (LAN, llama.cpp on a private IP, etc.)\n\
             set the env var `{ALLOW_INSECURE_HTTP_ENV}=1` in the shell that runs codewhale and re-run.\n\
             \n\
             Example: `{ALLOW_INSECURE_HTTP_ENV}=1 codewhale` (note the underscores).",
        );
    }

    anyhow::bail!(
        "Refusing base URL '{display_base_url}': only HTTPS (or explicitly allowed HTTP) URLs are supported.",
    )
}

pub(crate) fn redact_url_for_display(url: &str) -> String {
    let Ok(mut parsed) = reqwest::Url::parse(url) else {
        return url.to_string();

View on GitHub (pinned to 8880682c63)

Solutions

1. Set `CODEWHALE_ALLOW_INSECURE_HTTP=1` in the same shell that starts codewhale: `CODEWHALE_ALLOW_INSECURE_HTTP=1 codewhale` (underscores, value exactly 1 or true).
2. Prefer reconfiguring the server for HTTPS (reverse proxy with TLS) and keep the `https://` base_url.
3. Or bind the server to loopback and use `http://localhost:PORT` / `http://127.0.0.1:PORT`, which needs no env var.
4. If the env var seems set but still fails, confirm it is exported into codewhale's process (`env | grep ALLOW_INSECURE`) and spelled `CODEWHALE_ALLOW_INSECURE_HTTP`.

Example fix

# before (fails at startup)
export base_url='http://192.168.1.10:11434'
codewhale
# after
CODEWHALE_ALLOW_INSECURE_HTTP=1 codewhale

// Check before constructing/starting the client.
fn base_url_allowed(base_url: &str) -> bool {
    base_url.starts_with("https://")
        || base_url.starts_with("http://localhost")
        || base_url.starts_with("http://127.0.0.1")
        || base_url.starts_with("http://[::1]")
        || (base_url.starts_with("http://")
            && std::env::var("CODEWHALE_ALLOW_INSECURE_HTTP")
                .or_else(|_| std::env::var("DEEPSEEK_ALLOW_INSECURE_HTTP"))
                .is_ok_and(|v| v == "1" || v.eq_ignore_ascii_case("true")))
}

When it happens

Trigger: Setting a provider `base_url` like `http://192.168.1.10:11434` (Ollama on LAN), `http://10.0.0.5:8080` (llama.cpp on a private IP), or `http://myserver.local:8000` (vLLM/LM Studio on another machine) without the env var set, or with it set to some other value like `yes`/`on` (only `1` and case-insensitive `true` count), or exported in a different shell than the one launching codewhale.

Common situations: Running a local LLM server on a NAS/second box reachable only over LAN HTTP; using an HTTP-terminating proxy; after the DEEPSEEK->CODEWHALE rename the old env var still works as an alias, but a half-remembered name like `CODEWHALE_ALLOW_INSECURE` (missing `_HTTP`) does not.

Related errors

• Refusing base URL '{display_base_url}': only HTTPS (or expli
• Runtime API request failed (${status}): ${message}
• iLink API ${endpoint} failed: HTTP ${response.status} — ${te
• failed to fetch {description} from {url}: HTTP {status} {bod
• failed to fetch {description} from {url}

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/bf5902fd36cbb024. Report an issue: GitHub.