fix: terminal connections using Session auth fail Verify Connection and never load the terminal tools (#33699)

A terminal connection with Auth set to Session had no API key field, so Verify Connection, the policy settings and the tool list request all went out without the orchestrator's key and were rejected as unauthorized. That left the policy dropdown empty and chats failing with "Terminal server is unavailable". Session connections now have the API key field, and the key is sent for those admin and discovery calls the same way Bearer connections already do. Terminals that users open still sign in with the user's own session.

Fixes #30001
Fixes #33579

backend/open_webui/routers/configs.py

@@ -385,7 +385,7 @@ async def verify_terminal_server_connection(
         raise HTTPException(status_code=400, detail='Terminal server URL is required')
 
     headers = {}
-    if form_data.auth_type == 'bearer' and form_data.key:
+    if form_data.auth_type in ('bearer', 'session') and form_data.key:
         headers.update(bearer_auth_header(form_data.key))
 
     try:
@@ -458,7 +458,7 @@ async def put_terminal_server_policy(
         raise HTTPException(status_code=400, detail='Terminal server URL is required')
 
     headers = {'Content-Type': 'application/json'}
-    if form_data.auth_type == 'bearer' and form_data.key:
+    if form_data.auth_type in ('bearer', 'session') and form_data.key:
         headers.update(bearer_auth_header(form_data.key))
 
     try:
@@ -498,7 +498,7 @@ async def put_terminal_server_lifecycle(
         raise HTTPException(status_code=400, detail='Terminal server URL is required')
 
     headers = {'Content-Type': 'application/json'}
-    if form_data.auth_type == 'bearer' and form_data.key:
+    if form_data.auth_type in ('bearer', 'session') and form_data.key:
         headers.update(bearer_auth_header(form_data.key))
 
     try:
@@ -540,7 +540,7 @@ async def refresh_terminal_server_terminals(
         raise HTTPException(status_code=400, detail='Terminal server URL is required')
 
     headers = {'Content-Type': 'application/json'}
-    if form_data.auth_type == 'bearer' and form_data.key:
+    if form_data.auth_type in ('bearer', 'session') and form_data.key:
         headers.update(bearer_auth_header(form_data.key))
 
     body = {

backend/open_webui/utils/tools.py

@@ -1442,11 +1442,16 @@ async def set_terminal_servers(request: Request):
 
         base_url = get_terminal_server_url(connection)
 
+        # Spec discovery has no user, so Session connections use the orchestrator key
+        auth_type = connection.get('auth_type', 'bearer')
+        if auth_type == 'session':
+            auth_type = 'bearer'
+
         server_configs.append(
             {
                 'url': base_url,
                 'key': normalize_bearer_token(connection.get('key', '')),
-                'auth_type': connection.get('auth_type', 'bearer'),
+                'auth_type': auth_type,
                 'path': connection.get('path', '/openapi.json'),
                 'spec_type': 'url',
                 # get_tool_servers_data reads config.enable to filter active servers

src/lib/components/AddTerminalServerModal.svelte

@@ -1061,20 +1061,23 @@
 									</div>
 
 									<div class="flex flex-1 items-center">
-										{#if auth_type === 'bearer'}
-											<SensitiveInput
-												bind:value={key}
-												placeholder={$i18n.t('API Key')}
-												required={false}
-											/>
+										{#if auth_type === 'bearer' || auth_type === 'session'}
+											<div class="flex flex-col w-full gap-1">
+												<SensitiveInput
+													bind:value={key}
+													placeholder={$i18n.t('API Key')}
+													required={false}
+												/>
+												{#if auth_type === 'session'}
+													<div class={`text-xs text-gray-500`}>
+														{$i18n.t('Forwards system user session credentials to authenticate')}
+													</div>
+												{/if}
+											</div>
 										{:else if auth_type === 'none'}
 											<div class={`text-xs self-center translate-y-[1px] text-gray-500`}>
 												{$i18n.t('No authentication')}
 											</div>
-										{:else if auth_type === 'session'}
-											<div class={`text-xs self-center translate-y-[1px] text-gray-500`}>
-												{$i18n.t('Forwards system user session credentials to authenticate')}
-											</div>
 										{:else if auth_type === 'system_oauth'}
 											<div class={`text-xs self-center translate-y-[1px] text-gray-500`}>
 												{$i18n.t('Forwards system user OAuth access token to authenticate')}