From 5232f9bb2494468146ef54f9775e175bede8a1dc Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Tue, 3 Nov 2026 21:34:32 +0100
Subject: [PATCH] fix: terminal connections using Session auth fail Verify
 Connection and never load the terminal tools (#33699)

A terminal connection with Auth set to Session had no API key field, so Verify Connection, the policy settings and the tool list request all went out without the orchestrator's key and were rejected as unauthorized. That left the policy dropdown empty and chats failing with "Terminal server is unavailable". Session connections now have the API key field, and the key is sent for those admin and discovery calls the same way Bearer connections already do. Terminals that users open still sign in with the user's own session.

Fixes #30001
Fixes #33579
---
 backend/open_webui/routers/configs.py         |  8 +++----
 backend/open_webui/utils/tools.py             |  7 +++++-
 .../components/AddTerminalServerModal.svelte  | 23 +++++++++++--------
 3 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/backend/open_webui/routers/configs.py b/backend/open_webui/routers/configs.py
index b9f0cec932..1a0608ea51 100644
--- a/backend/open_webui/routers/configs.py
+++ b/backend/open_webui/routers/configs.py
@@ -385,7 +385,7 @@ async def verify_terminal_server_connection(
         raise HTTPException(status_code=400, detail='Terminal server URL is required')
 
     headers = {}
-    if form_data.auth_type == 'bearer' and form_data.key:
+    if form_data.auth_type in ('bearer', 'session') and form_data.key:
         headers.update(bearer_auth_header(form_data.key))
 
     try:
@@ -458,7 +458,7 @@ async def put_terminal_server_policy(
         raise HTTPException(status_code=400, detail='Terminal server URL is required')
 
     headers = {'Content-Type': 'application/json'}
-    if form_data.auth_type == 'bearer' and form_data.key:
+    if form_data.auth_type in ('bearer', 'session') and form_data.key:
         headers.update(bearer_auth_header(form_data.key))
 
     try:
@@ -498,7 +498,7 @@ async def put_terminal_server_lifecycle(
         raise HTTPException(status_code=400, detail='Terminal server URL is required')
 
     headers = {'Content-Type': 'application/json'}
-    if form_data.auth_type == 'bearer' and form_data.key:
+    if form_data.auth_type in ('bearer', 'session') and form_data.key:
         headers.update(bearer_auth_header(form_data.key))
 
     try:
@@ -540,7 +540,7 @@ async def refresh_terminal_server_terminals(
         raise HTTPException(status_code=400, detail='Terminal server URL is required')
 
     headers = {'Content-Type': 'application/json'}
-    if form_data.auth_type == 'bearer' and form_data.key:
+    if form_data.auth_type in ('bearer', 'session') and form_data.key:
         headers.update(bearer_auth_header(form_data.key))
 
     body = {
diff --git a/backend/open_webui/utils/tools.py b/backend/open_webui/utils/tools.py
index 97ef2c8030..e9ec1cd6d9 100644
--- a/backend/open_webui/utils/tools.py
+++ b/backend/open_webui/utils/tools.py
@@ -1442,11 +1442,16 @@ async def set_terminal_servers(request: Request):
 
         base_url = get_terminal_server_url(connection)
 
+        # Spec discovery has no user, so Session connections use the orchestrator key
+        auth_type = connection.get('auth_type', 'bearer')
+        if auth_type == 'session':
+            auth_type = 'bearer'
+
         server_configs.append(
             {
                 'url': base_url,
                 'key': normalize_bearer_token(connection.get('key', '')),
-                'auth_type': connection.get('auth_type', 'bearer'),
+                'auth_type': auth_type,
                 'path': connection.get('path', '/openapi.json'),
                 'spec_type': 'url',
                 # get_tool_servers_data reads config.enable to filter active servers
diff --git a/src/lib/components/AddTerminalServerModal.svelte b/src/lib/components/AddTerminalServerModal.svelte
index 7c3f6d1486..a578e1e99c 100644
--- a/src/lib/components/AddTerminalServerModal.svelte
+++ b/src/lib/components/AddTerminalServerModal.svelte
@@ -1061,20 +1061,23 @@
 									</div>
 
 									<div class="flex flex-1 items-center">
-										{#if auth_type === 'bearer'}
-											<SensitiveInput
-												bind:value={key}
-												placeholder={$i18n.t('API Key')}
-												required={false}
-											/>
+										{#if auth_type === 'bearer' || auth_type === 'session'}
+											<div class="flex flex-col w-full gap-1">
+												<SensitiveInput
+													bind:value={key}
+													placeholder={$i18n.t('API Key')}
+													required={false}
+												/>
+												{#if auth_type === 'session'}
+													<div class={`text-xs text-gray-500`}>
+														{$i18n.t('Forwards system user session credentials to authenticate')}
+													</div>
+												{/if}
+											</div>
 										{:else if auth_type === 'none'}
 											<div class={`text-xs self-center translate-y-[1px] text-gray-500`}>
 												{$i18n.t('No authentication')}
 											</div>
-										{:else if auth_type === 'session'}
-											<div class={`text-xs self-center translate-y-[1px] text-gray-500`}>
-												{$i18n.t('Forwards system user session credentials to authenticate')}
-											</div>
 										{:else if auth_type === 'system_oauth'}
 											<div class={`text-xs self-center translate-y-[1px] text-gray-500`}>
 												{$i18n.t('Forwards system user OAuth access token to authenticate')}