diff --git a/backend/open_webui/routers/configs.py b/backend/open_webui/routers/configs.py
index b9f0cec932..1a0608ea51 100644
--- a/backend/open_webui/routers/configs.py
+++ b/backend/open_webui/routers/configs.py
@@ -385,7 +385,7 @@ async def verify_terminal_server_connection(
         raise HTTPException(status_code=400, detail='Terminal server URL is required')
 
     headers = {}
-    if form_data.auth_type == 'bearer' and form_data.key:
+    if form_data.auth_type in ('bearer', 'session') and form_data.key:
         headers.update(bearer_auth_header(form_data.key))
 
     try:
@@ -458,7 +458,7 @@ async def put_terminal_server_policy(
         raise HTTPException(status_code=400, detail='Terminal server URL is required')
 
     headers = {'Content-Type': 'application/json'}
-    if form_data.auth_type == 'bearer' and form_data.key:
+    if form_data.auth_type in ('bearer', 'session') and form_data.key:
         headers.update(bearer_auth_header(form_data.key))
 
     try:
@@ -498,7 +498,7 @@ async def put_terminal_server_lifecycle(
         raise HTTPException(status_code=400, detail='Terminal server URL is required')
 
     headers = {'Content-Type': 'application/json'}
-    if form_data.auth_type == 'bearer' and form_data.key:
+    if form_data.auth_type in ('bearer', 'session') and form_data.key:
         headers.update(bearer_auth_header(form_data.key))
 
     try:
@@ -540,7 +540,7 @@ async def refresh_terminal_server_terminals(
         raise HTTPException(status_code=400, detail='Terminal server URL is required')
 
     headers = {'Content-Type': 'application/json'}
-    if form_data.auth_type == 'bearer' and form_data.key:
+    if form_data.auth_type in ('bearer', 'session') and form_data.key:
         headers.update(bearer_auth_header(form_data.key))
 
     body = {
diff --git a/backend/open_webui/utils/tools.py b/backend/open_webui/utils/tools.py
index 97ef2c8030..e9ec1cd6d9 100644
--- a/backend/open_webui/utils/tools.py
+++ b/backend/open_webui/utils/tools.py
@@ -1442,11 +1442,16 @@ async def set_terminal_servers(request: Request):
 
         base_url = get_terminal_server_url(connection)
 
+        # Spec discovery has no user, so Session connections use the orchestrator key
+        auth_type = connection.get('auth_type', 'bearer')
+        if auth_type == 'session':
+            auth_type = 'bearer'
+
         server_configs.append(
             {
                 'url': base_url,
                 'key': normalize_bearer_token(connection.get('key', '')),
-                'auth_type': connection.get('auth_type', 'bearer'),
+                'auth_type': auth_type,
                 'path': connection.get('path', '/openapi.json'),
                 'spec_type': 'url',
                 # get_tool_servers_data reads config.enable to filter active servers
diff --git a/src/lib/components/AddTerminalServerModal.svelte b/src/lib/components/AddTerminalServerModal.svelte
index 7c3f6d1486..a578e1e99c 100644
--- a/src/lib/components/AddTerminalServerModal.svelte
+++ b/src/lib/components/AddTerminalServerModal.svelte
@@ -1061,20 +1061,23 @@
 									</div>
 
 									<div class="flex flex-1 items-center">
-										{#if auth_type === 'bearer'}
-											<SensitiveInput
-												bind:value={key}
-												placeholder={$i18n.t('API Key')}
-												required={false}
-											/>
+										{#if auth_type === 'bearer' || auth_type === 'session'}
+											<div class="flex flex-col w-full gap-1">
+												<SensitiveInput
+													bind:value={key}
+													placeholder={$i18n.t('API Key')}
+													required={false}
+												/>
+												{#if auth_type === 'session'}
+													<div class={`text-xs text-gray-500`}>
+														{$i18n.t('Forwards system user session credentials to authenticate')}
+													</div>
+												{/if}
+											</div>
 										{:else if auth_type === 'none'}
 											<div class={`text-xs self-center translate-y-[1px] text-gray-500`}>
 												{$i18n.t('No authentication')}
 											</div>
-										{:else if auth_type === 'session'}
-											<div class={`text-xs self-center translate-y-[1px] text-gray-500`}>
-												{$i18n.t('Forwards system user session credentials to authenticate')}
-											</div>
 										{:else if auth_type === 'system_oauth'}
 											<div class={`text-xs self-center translate-y-[1px] text-gray-500`}>
 												{$i18n.t('Forwards system user OAuth access token to authenticate')}