coder/code-server · error · Error

--hashed-password can only be set in the config file or pass

Error message

--hashed-password can only be set in the config file or passed in via $HASHED_PASSWORD

What it means

Same security guard as --password, applied to `--hashed-password` at cli.ts:411. Hashed passwords (bcrypt/argon2-style) are still secrets and are rejected on the command line for the same process-list visibility reason. Provide the hash via the config file or $HASHED_PASSWORD.

Source

Thrown at src/node/cli.ts:411

        value = split[1]
      } else {
        const short = arg.replace(/^-/, "")
        const pair = Object.entries(options).find(([, v]) => v.short === short)
        if (pair) {
          key = pair[0] as keyof UserProvidedArgs
        }
      }

      if (!key || !options[key]) {
        throw error(`Unknown option ${arg}`)
      }

      if (key === "password" && !opts?.configFile) {
        throw new Error("--password can only be set in the config file or passed in via $PASSWORD")
      }

      if (key === "hashed-password" && !opts?.configFile) {
        throw new Error("--hashed-password can only be set in the config file or passed in via $HASHED_PASSWORD")
      }

      if (key === "github-auth" && !opts?.configFile) {
        throw new Error("--github-auth can only be set in the config file or passed in via $GITHUB_TOKEN")
      }

      if (key === "idle-timeout-seconds" && Number(value) <= 60) {
        throw new Error("--idle-timeout-seconds must be greater than 60 seconds.")
      }

      const option = options[key]
      if (option.type === "boolean") {
        ;(args[key] as boolean) = true
        continue
      }

      // Might already have a value if it was the --long=value format.
      if (typeof value === "undefined") {

View on GitHub (pinned to 51f90a376b)

Solutions

1. Set `hashed-password:` in the config file
2. Export `HASHED_PASSWORD` in the environment before launching code-server
3. Generate the hash once (`echo -n 'pass' | npx argon2-cli -e`) and store it in a secrets manager that populates the env var

Example fix

# before
code-server --hashed-password='$argon2id$...'

# after
export HASHED_PASSWORD='$argon2id$...'
code-server

const SECRET_FLAGS = ["--password", "--hashed-password", "--github-auth"]
const leaked = process.argv.filter((a) =>
  SECRET_FLAGS.some((f) => a === f || a.startsWith(f + "="))
)
if (leaked.length) {
  throw new Error(`Refusing to run: ${leaked.join(", ")} on the CLI. Use $HASHED_PASSWORD / config file.`)
}

When it happens

Trigger: Running `code-server --hashed-password='$argon2id$...'` or `--hashed-password=<bcrypt-hash>` from the command line.

Common situations: Operators migrating from plaintext to hashed passwords who pass the hash inline; automation scripts that build the hash and append it as a flag.

Related errors

• --password can only be set in the config file or passed in v
• --github-auth can only be set in the config file or passed i
• --cert-key is missing
• --idle-timeout-seconds must be greater than 60 seconds.
• No opened code-server instances found to handle ${paths[0]}

AI-assisted analysis of coder/code-server@51f90a376b (2026-08-12). Data as JSON: /api/errors/74ed4bf56289423b. Report an issue: GitHub.