# NousResearch/hermes-agent · Dashboard API auth and header case bugs

## Open now

- Nothing open on GitHub.

Multiple issues and fixes centered on dashboard API authentication failures (401/404 errors) and header case sensitivity problems, particularly in rate limit parsing and session token lookup. Related fixes touch Kanban board loading, OAuth gating, and SPA token refresh behavior.

## TL;DR

- 10 member(s): 0 open issue(s), 6 closed issue(s), 0 open PR(s), 1 merged PR(s), 3 PR(s) closed without merging.
- A fix was merged to main in PR #7174. Verify it addresses your case.
- **Recommended:** read PR #7174 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_PARTIAL`): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
- Members outside that structural core may belong to a different underlying problem.
- Pairwise link density `0.14`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #7018: bug: parse_rate_limit_headers silently returns all-zero buckets for non-lowercase header keys
- #16726: Dashboard: /api/skills returns 401 Unauthorized on v0.11+ (header case mismatch)
- #24186: Hermes update broke Kanban — 401 Unauthorized on board load
- #25275: \[BUG\] Analytics dashboard API returns 401 Unauthorized after v0.13.0 update
- #29183: \[bug\]: hardcoded "***" session token
- #46205: \[Bug\]: Kanban dashboard fails to load with 404 "No such API endpoint: /api/plugins/kanban/board" despite plugin being registered

## Prior & competing PRs

- **#7174: fix: four small CLI/config fixes (Bucket K salvage)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`; implication `superseded`
  - files: `agent/rate_limit_tracker.py`, `agent/smart_model_routing.py`, `cli.py`, `hermes_cli/gateway.py`
- **#7019: fix: normalize headers to lowercase in parse_rate_limit_headers**. closed without merge
  - maintainer direction: category `merged_via`; implication `superseded`; refs `#7174`
- **#16758: fix(dashboard): normalize session header lookup to lowercase**. closed without merge
  - maintainer direction: category `wontfix_bydesign`; implication `wontfix`; refs `#16726`, `#16726`
- **#46398: fix(kanban): keep dashboard API mounted without multipart**. closed without merge
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `c661634537a600a411c0371accf862e7bce5029f`, `#46205`

## Fix status

- Merged to main in PR #7174 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-04-10`. This confirmation is old and may be out of date (a revert/reopen would not have invalidated it here); re-verify.
- Subsystem: `agent`