coder/code-server · critical · Error

Please pass in a password via the config file or environment

Error message

Please pass in a password via the config file or environment variable ($PASSWORD or $HASHED_PASSWORD)

What it means

At startup (main.ts:137) code-server validates that, when auth === AuthType.Password, at least one of `password` or `hashed-password` is set. If neither is configured the server refuses to start, because it would otherwise listen with password auth but no credential to check against.

Source

Thrown at src/node/main.ts:137

  vscode.end()
}

export const runCodeServer = async (
  args: DefaultedArgs,
): Promise<{ dispose: Disposable["dispose"]; server: http.Server }> => {
  logger.info(`code-server ${version} ${commit}`)

  // Load custom strings if provided
  if (args.i18n) {
    await loadCustomStrings(args.i18n)
    logger.info("Loaded custom strings")
  }

  logger.info(`Using user-data-dir ${args["user-data-dir"]}`)
  logger.debug(`Using extensions-dir ${args["extensions-dir"]}`)

  if (args.auth === AuthType.Password && !args.password && !args["hashed-password"]) {
    throw new Error(
      "Please pass in a password via the config file or environment variable ($PASSWORD or $HASHED_PASSWORD)",
    )
  }

  const app = await createApp(args)
  const protocol = args.cert ? "https" : "http"
  const serverAddress = ensureAddress(app.server, protocol)
  const { disposeRoutes, heart } = await register(app, args)

  logger.info(`Using config file ${args.config}`)
  logger.info(`${protocol.toUpperCase()} server listening on ${serverAddress.toString()}`)
  if (args.auth === AuthType.Password) {
    logger.info("  - Authentication is enabled")
    if (args.usingEnvPassword) {
      logger.info("    - Using password from $PASSWORD")
    } else if (args.usingEnvHashedPassword) {
      logger.info("    - Using password from $HASHED_PASSWORD")
    } else if (args["hashed-password"]) {

View on GitHub (pinned to 51f90a376b)

Solutions

1. Set PASSWORD or HASHED_PASSWORD in the environment before launch
2. Add `password:` (or `hashed-password:`) to ~/.config/code-server/config.yaml
3. If no auth is desired on a trusted network, set `auth: none` instead

Example fix

# before
code-server   # auth defaults to 'password', no password set

# after
export PASSWORD=correct-horse-battery-staple
code-server
# or config.yaml:
# auth: password
# password: correct-horse-battery-staple

function validatePasswordConfig(args: {
  auth?: AuthType
  password?: string
  "hashed-password"?: string
}): void {
  if (args.auth === AuthType.Password && !args.password && !args["hashed-password"]) {
    throw new Error("auth=password requires PASSWORD or HASHED_PASSWORD to be set")
  }
}

function hasPasswordConfig(args: {
  password?: string
  "hashed-password"?: string
}): boolean {
  return Boolean(args.password || args["hashed-password"])
}

When it happens

Trigger: Running `code-server` (or with `auth: password` in config) without setting PASSWORD, HASHED_PASSWORD, `password:`, or `hashed-password:`. Common in fresh installs that default to password auth.

Common situations: First run after install with no config; CI/containers that set auth to password but forget the credential; purging the env and not restoring the password.

Related errors

• --password can only be set in the config file or passed in v
• --hashed-password can only be set in the config file or pass
• --github-auth can only be set in the config file or passed i
• --cert-key is missing
• invalid config: ${config}

AI-assisted analysis of coder/code-server@51f90a376b (2026-08-12). Data as JSON: /api/errors/770433cf9b59a1dd. Report an issue: GitHub.