Bug: 401 Unauthorized on Gluetun API even with valid credentials and config.toml

[shazharrahim]

Is this urgent?

yes

Host OS

No response

CPU arch

None

VPN service provider

Surfshark

What are you using to run the container

docker run

What is the version of Gluetun

v3.39.0

What's the problem 🤔

Hi 👋
I’m trying to use the Gluetun control server with basic authentication enabled.

Here’s what I’ve done:
• Mounted this config file at /gluetun/auth/config.toml:
[users."api"] password = "supersecret"

•	My docker-compose.yml includes:

ports: - "8000:8000" volumes: - ./data/gluetun:/gluetun environment: - GLUETUN_CONTROL_SERVER_AUTHENTICATION=on - GLUETUN_CONTROL_SERVER_USER=api - GLUETUN_CONTROL_SERVER_PASSWORD=supersecret

I tried both the GLUETUN_CONTROL_SERVER_* env vars and the config file just to be safe.

Still, I keep getting:
`curl -u api:supersecret http://localhost:8000/v1/public-ip

Unauthorized`
The logs confirm it’s reading /gluetun/auth/config.toml, but still returns 401.

Any ideas what I might be missing?

Thanks in advance 🙏

Share your logs (at least 10 lines)

2025-07-14T19:57:31+05:00 INFO [openvpn] UDPv4 link remote: [AF_INET]154.47.25.11:1194
2025-07-14T19:57:31+05:00 INFO [openvpn] [us-chi-v081.prod.surfshark.com] Peer Connection Initiated with [AF_INET]154.47.25.11:1194
2025-07-14T19:57:32+05:00 ERROR [openvpn] Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:7: block-outside-dns (2.6.11)
2025-07-14T19:57:32+05:00 INFO [openvpn] TUN/TAP device tun0 opened
2025-07-14T19:57:32+05:00 INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500
2025-07-14T19:57:32+05:00 INFO [openvpn] /sbin/ip link set dev tun0 up
2025-07-14T19:57:32+05:00 INFO [openvpn] /sbin/ip addr add dev tun0 10.8.8.16/24
2025-07-14T19:57:32+05:00 INFO [openvpn] UID set to nonrootuser
2025-07-14T19:57:32+05:00 INFO [openvpn] Initialization Sequence Completed
2025-07-14T19:57:32+05:00 INFO [dns] downloading hostnames and IP block lists
2025-07-14T19:57:32+05:00 INFO [healthcheck] healthy!
2025-07-14T19:57:36+05:00 INFO [dns] DNS server listening on [::]:53
2025-07-14T19:57:36+05:00 INFO [dns] ready
2025-07-14T19:57:37+05:00 WARN [ip getter] ipinfo: too many requests sent for this month from https://ipinfo.io/: 429 429 Too Many Requests
2025-07-14T19:57:37+05:00 INFO [ip getter] Public IP address is 154.47.25.8 (United States, Illinois, Chicago - source: ifconfig.co)
2025-07-14T19:57:37+05:00 INFO [vpn] You are running 1 commit behind the most recent latest
2025-07-14T19:58:04+05:00 INFO [http server] 401 GET /v1/public-ip wrote 13B to 172.18.0.1:51648 in 114.663µs

Share your configuration

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[mjtbrady]

Where did you get that toml file and those environment variables from?

Documentation is here https://github.com/qdm12/gluetun-wiki/blob/main/setup/advanced/control-server.md#authentication,

I would suggest the following config.toml

[[roles]]
name = "publicip"
# Define a list of routes with the syntax "Http-Method /path"
routes = ["GET /v1/publicip/ip"]
# Define an authentication method with its parameters
auth = "basic"
username = "api"
password = "supersecret"

I use the apikey method myself.

[shazharrahim]

Where did you get that toml file and those environment variables from?

Documentation is here https://github.com/qdm12/gluetun-wiki/blob/main/setup/advanced/control-server.md#authentication,

I would suggest the following config.toml

[[roles]]
name = "publicip"
# Define a list of routes with the syntax "Http-Method /path"
routes = ["GET /v1/publicip/ip"]
# Define an authentication method with its parameters
auth = "basic"
username = "api"
password = "supersecret"

I use the apikey method myself.

Thank also is there any endpoint to change the vpn country ?

[shazharrahim]

Specifically like i want to connect to Malaysia or others by giveing in the endpoint body? Is this possible? Thanks

[mjtbrady]

Not that I know of.