{"record":{"id":"24a60a4854092aed","repo":"AUTOMATIC1111/stable-diffusion-webui","slug":"incorrect-username-or-password","errorCode":null,"errorMessage":"Incorrect username or password","messagePattern":"Incorrect username or password","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"modules/api/api.py","lineNumber":284,"sourceCode":"\n        if not img2img_script_runner.scripts:\n            img2img_script_runner.initialize_scripts(True)\n        if not self.default_script_arg_img2img:\n            self.default_script_arg_img2img = self.init_default_script_args(img2img_script_runner)\n\n\n\n    def add_api_route(self, path: str, endpoint, **kwargs):\n        if shared.cmd_opts.api_auth:\n            return self.app.add_api_route(path, endpoint, dependencies=[Depends(self.auth)], **kwargs)\n        return self.app.add_api_route(path, endpoint, **kwargs)\n\n    def auth(self, credentials: HTTPBasicCredentials = Depends(HTTPBasic())):\n        if credentials.username in self.credentials:\n            if compare_digest(credentials.password, self.credentials[credentials.username]):\n                return True\n\n        raise HTTPException(status_code=401, detail=\"Incorrect username or password\", headers={\"WWW-Authenticate\": \"Basic\"})\n\n    def get_selectable_script(self, script_name, script_runner):\n        if script_name is None or script_name == \"\":\n            return None, None\n\n        script_idx = script_name_to_index(script_name, script_runner.selectable_scripts)\n        script = script_runner.selectable_scripts[script_idx]\n        return script, script_idx\n\n    def get_scripts_list(self):\n        t2ilist = [script.name for script in scripts.scripts_txt2img.scripts if script.name is not None]\n        i2ilist = [script.name for script in scripts.scripts_img2img.scripts if script.name is not None]\n\n        return models.ScriptsList(txt2img=t2ilist, img2img=i2ilist)\n\n    def get_script_info(self):\n        res = []\n","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/82a973c04367123ae98bd9abdf80d9eda9b910e2/modules/api/api.py#L266-L302","documentation":"HTTP 401 raised by the API's HTTP Basic auth handler when the request's username is not a key in self.credentials or compare_digest fails on the password. This only applies when the server was started with --api-auth user:pass[,user2:pass2]; the FastAPI route dependency HTTPBasic collects the credentials and every API route added through add_api_route requires them.","triggerScenarios":"Any /sdapi/v1/* request without an Authorization: Basic header, with a wrong username, wrong password, or a user not listed in --api-auth; also common when a client sends a Bearer token or api key in another header instead of Basic auth.","commonSituations":"Credentials rotated but the client cached old ones; colon missing in --api-auth so parsing yields different users; proxies (nginx/traefik) stripping the Authorization header; clients URL-embedding user:pass incorrectly (special chars like @ needing percent-encoding).","solutions":["Send HTTP Basic auth: requests.post(url, auth=('user','pass'), ...) with exactly the pair passed to --api-auth","Verify the server command line contains --api-auth user:pass and restart if it was changed","If behind a reverse proxy, confirm it forwards the Authorization header","Percent-encode special characters in passwords embedded in URLs, or pass auth via the client library"],"exampleFix":"# before\nrequests.post('http://127.0.0.1:7860/sdapi/v1/txt2img', json=payload)  # 401\n\n# after\nrequests.post('http://127.0.0.1:7860/sdapi/v1/txt2img', json=payload, auth=('user','pass'))","handlingStrategy":"try-catch","validationCode":"# client: verify auth works before heavy calls\nprobe = requests.get(f'{base}/sdapi/v1/cmd-flags', auth=(user, pw))\nif probe.status_code == 401:\n    raise PermissionError('bad api credentials; check --api-auth user:pass on server')","typeGuard":null,"tryCatchPattern":"resp = requests.post(url, json=payload, auth=(user, pw))\nif resp.status_code == 401:\n    raise PermissionError('Incorrect username or password: verify --api-auth pairs and header forwarding')","preventionTips":["Pass auth via the HTTP library, not URL-embedded strings","Keep credentials in env vars synced with the server's --api-auth list","Confirm reverse proxies forward the Authorization header"],"tags":["api","authentication","http-401","http-basic","stable-diffusion-webui"],"backgroundTag":null,"analyzedSha":"82a973c04367123ae98bd9abdf80d9eda9b910e2","analyzedAt":"2026-08-14T16:46:43.225Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}