Area
Dashboard
What are you trying to accomplish?
I operate the dashboard on a remote bind (non-loopback, behind a reverse proxy on a k3s/homelab hub). I open the dashboard from desktop and mobile browsers and need the session to persist across page reloads and browser restarts without re-entering the raw admin token.
What prevents this today?
Per the management-auth docs, session issuance is disabled whenever data-plane authentication is required (remote binds):
Session issuance is disabled whenever data-plane authentication is required, which includes remote binds. A remote operator must authenticate with the raw admin token; no loopback-style GUI session is minted.
Loopback binds get short-lived ocx_session_* credentials (5 minutes), but remote operators are left with the raw admin token prompt on every fresh page load / browser session. There is no configurable session lifetime and no alternative auth path for the remote-bind dashboard.
What should OpenCodex do?
When a remote operator enters the admin token once, the dashboard should issue a persistent GUI session (cookie with SameSite=Lax + HttpOnly) whose lifetime the operator controls, so that reloading the page or reopening the browser does not prompt for the token again until the configured TTL expires.
Concretely, at least one of:
dashboard.sessionTtlMinutes config key (default 5 for loopback parity; remote operators can raise to hours/days at their own risk).- Alternative non-token auth: reverse-proxy Basic auth pass-through, OIDC/SSO callback, or a "remember this device" scoped credential.
Example usage or interface
In ~/.opencodex/config.json:
{
"dashboard": {
"sessionTtlMinutes": 1440
}
}Or via CLI:
ocx config set dashboard.sessionTtlMinutes 1440
Before: reload dashboard → window.prompt("OpenCodex API token") on every page load.
After: reload dashboard → session restored from cookie until TTL expires; prompt only appears again after expiry.
Alternatives or workarounds
- Storing the raw admin token in browser localStorage / password-manager autofill — defeats the masking posture the dashboard otherwise maintains (credential redaction in management responses).
- Tunneling the dashboard through an SSH/loopback proxy so the loopback session path applies — awkward on mobile.
Additional context
Checks
Area
Dashboard
What are you trying to accomplish?
I operate the dashboard on a remote bind (non-loopback, behind a reverse proxy on a k3s/homelab hub). I open the dashboard from desktop and mobile browsers and need the session to persist across page reloads and browser restarts without re-entering the raw admin token.
What prevents this today?
Per the management-auth docs, session issuance is disabled whenever data-plane authentication is required (remote binds):
Loopback binds get short-lived
ocx_session_*credentials (5 minutes), but remote operators are left with the raw admin token prompt on every fresh page load / browser session. There is no configurable session lifetime and no alternative auth path for the remote-bind dashboard.What should OpenCodex do?
When a remote operator enters the admin token once, the dashboard should issue a persistent GUI session (cookie with
SameSite=Lax+HttpOnly) whose lifetime the operator controls, so that reloading the page or reopening the browser does not prompt for the token again until the configured TTL expires.Concretely, at least one of:
dashboard.sessionTtlMinutesconfig key (default5for loopback parity; remote operators can raise to hours/days at their own risk).Example usage or interface
In
~/.opencodex/config.json:{ "dashboard": { "sessionTtlMinutes": 1440 } }Or via CLI:
ocx config set dashboard.sessionTtlMinutes 1440Before: reload dashboard →
window.prompt("OpenCodex API token")on every page load.After: reload dashboard → session restored from cookie until TTL expires; prompt only appears again after expiry.
Alternatives or workarounds
Additional context
Checks