coder/code-server · error · Error

--github-auth can only be set in the config file or passed i

Error message

--github-auth can only be set in the config file or passed in via $GITHUB_TOKEN

What it means

Same secret-rejection guard, applied to `--github-auth` at cli.ts:415. A GitHub OAuth token is a credential and must not appear in argv. Provide it through the config file or the $GITHUB_TOKEN environment variable.

Source

Thrown at src/node/cli.ts:415

        if (pair) {
          key = pair[0] as keyof UserProvidedArgs
        }
      }

      if (!key || !options[key]) {
        throw error(`Unknown option ${arg}`)
      }

      if (key === "password" && !opts?.configFile) {
        throw new Error("--password can only be set in the config file or passed in via $PASSWORD")
      }

      if (key === "hashed-password" && !opts?.configFile) {
        throw new Error("--hashed-password can only be set in the config file or passed in via $HASHED_PASSWORD")
      }

      if (key === "github-auth" && !opts?.configFile) {
        throw new Error("--github-auth can only be set in the config file or passed in via $GITHUB_TOKEN")
      }

      if (key === "idle-timeout-seconds" && Number(value) <= 60) {
        throw new Error("--idle-timeout-seconds must be greater than 60 seconds.")
      }

      const option = options[key]
      if (option.type === "boolean") {
        ;(args[key] as boolean) = true
        continue
      }

      // Might already have a value if it was the --long=value format.
      if (typeof value === "undefined") {
        // A value is only valid if it doesn't look like an option.
        value = argv[i + 1] && !argv[i + 1].startsWith("-") ? argv[++i] : undefined
      }

View on GitHub (pinned to 51f90a376b)

Solutions

1. Set `github-auth:` in the config file
2. Export `GITHUB_TOKEN` in the environment
3. If using a token from a secrets broker, write it to the env var at container start rather than the command line

Example fix

# before
code-server --github-auth=ghp_xxxxx

# after
export GITHUB_TOKEN=ghp_xxxxx
code-server

const SECRET_FLAGS = ["--password", "--hashed-password", "--github-auth"]
const leaked = process.argv.filter((a) =>
  SECRET_FLAGS.some((f) => a === f || a.startsWith(f + "="))
)
if (leaked.length) {
  throw new Error(`Refusing to run: ${leaked.join(", ")} on the CLI. Use $GITHUB_TOKEN / config file.`)
}

When it happens

Trigger: Running `code-server --github-auth=ghp_xxxxx` or passing the token as a CLI flag.

Common situations: Enabling GitHub auth for extensions cloning private repos; CI scripts that inject the token as a flag rather than an env var.

Related errors

• --password can only be set in the config file or passed in v
• --hashed-password can only be set in the config file or pass
• --cert-key is missing
• --idle-timeout-seconds must be greater than 60 seconds.
• No opened code-server instances found to handle ${paths[0]}

AI-assisted analysis of coder/code-server@51f90a376b (2026-08-12). Data as JSON: /api/errors/b74bcbc410a6a8aa. Report an issue: GitHub.