# NousResearch/hermes-agent · Dashboard gated/basic_auth mode: session token and OAuth/reveal issues

## Open now

- Nothing open on GitHub.

Members describe problems in the dashboard's gated (basic_auth) mode, where a legacy session token placeholder is reportedly not injected, affecting model-provider OAuth login and the Keys page reveal button. Several pull requests propose related changes such as injecting a token or using cookie/fetchJSON auth, but the members do not confirm outcomes.

## TL;DR

- 7 member(s): 0 open issue(s), 3 closed issue(s), 0 open PR(s), 0 merged PR(s), 4 PR(s) closed without merging.
- No fix has been merged to main; one or more PRs were attempted (see below).
- **Recommended:** review the prior/competing PR(s) below. A fix was attempted but not merged; your case may extend or revive that work.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_PARTIAL`): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
- Members outside that structural core may belong to a different underlying problem.
- Pairwise link density `0.24`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #55210: Bug: Dashboard Keys page reveal button throws in gated (basic_auth) mode — frontend never sends the request
- #58207: \[Bug\]: Dashboard OAuth provider login fails in gated mode because startOAuthLogin requires legacy session token
- #59274: Dashboard model-provider OAuth fails under basic_auth: \`__HERMES_SESSION_TOKEN__\` never injected ("Session token not available")

## Prior & competing PRs

- **#55220: fix(dashboard): use fetchJSON auth in revealEnvVar for gated mode**. closed without merge · fix tier `suggested`
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `#51156`
- **#55221: fix(dashboard): inject placeholder session token in gated mode so reveal works**. closed without merge · fix tier `suggested`
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `3e24b16f566045399012bc1185fe0cdb6e1a1be9`, `#51156`, `#55220`
  - _suggested-tier fix detail withheld; re-request with `?tier=all` to include it._
- **#59663: fix(dashboard): inject session token in gated index.html so model-provider OAuth works under basic_auth (#59274)**. closed without merge · fix tier `suggested`
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `3e24b16f566045399012bc1185fe0cdb6e1a1be9`, `#59274`
- **#58211: fix(dashboard): allow provider oauth with cookie auth**. closed without merge
  - maintainer direction: category `uncategorized`; implication `needs_llm`; refs `3e24b16f566045399012bc1185fe0cdb6e1a1be9`

## Fix status

- No merged fix on record.
- Subsystem: `dashboard`