Repository navigation
feat(QBittorrent): port API-key auth from Radarr/Sonarr - #1
Merged
Jaffa00 merged 1 commit intoJun 9, 2026
Merged
Conversation
qBittorrent 5.x added API-key authentication as an alternative to the
classic username/password cookie flow. Radarr and Sonarr support it;
bookshelf doesn't yet. Port the additions verbatim (adapted to
bookshelf's existing settings layout — no other refactors).
Changes:
src/NzbDrone.Core/Download/Clients/QBittorrent/QBittorrentSettings.cs
* New `ApiKey` field at FieldDefinition(4), with PrivacyLevel.ApiKey
so it's masked in the UI and logs.
* Validator rejects configurations where ApiKey is set AND
Username/Password are also set, mirroring Radarr's rule.
* Renumber existing fields (5..14) to make room for the ApiKey
field where users naturally look for it (right above Username).
Property names are unchanged so existing stored configs are
preserved.
src/NzbDrone.Core/Download/Clients/QBittorrent/QBittorrentProxyV2.cs
* BuildRequest now emits `Authorization: Bearer <key>` when ApiKey
is set, and only attaches BasicNetworkCredential when falling back
to username/password. Mixing the two would be redundant and could
confuse some qBit middlewares.
* ProcessRequest gains a fast path for the ApiKey case that skips
AuthenticateClient (no cookie session needed) and routes 401/403
to DownloadClientAuthenticationException directly, matching the
Radarr/Sonarr pattern.
Independent of pennydreadful#162: this change builds and works whether or not the
auth-response-handling fix has landed yet. Users on classic
username/password auth see no behavior change.
References:
https://github.com/Radarr/Radarr/blob/develop/src/NzbDrone.Core/Download/Clients/QBittorrent/QBittorrentSettings.cs
https://github.com/Radarr/Radarr/blob/develop/src/NzbDrone.Core/Download/Clients/QBittorrent/QBittorrentProxyV2.cs
Jaffa00
marked this pull request as ready for review
June 9, 2026 20:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
qBittorrent 5.x added API-key authentication as an alternative to the classic username/password cookie flow. Radarr and Sonarr support it; bookshelf doesn't yet. Port the additions verbatim (adapted to bookshelf's existing settings layout — no other refactors).
Changes:
src/NzbDrone.Core/Download/Clients/QBittorrent/QBittorrentSettings.cs
* New
ApiKeyfield at FieldDefinition(4), with PrivacyLevel.ApiKey so it's masked in the UI and logs.* Validator rejects configurations where ApiKey is set AND Username/Password are also set, mirroring Radarr's rule.
* Renumber existing fields (5..14) to make room for the ApiKey field where users naturally look for it (right above Username). Property names are unchanged so existing stored configs are preserved.
src/NzbDrone.Core/Download/Clients/QBittorrent/QBittorrentProxyV2.cs
* BuildRequest now emits
Authorization: Bearer <key>when ApiKey is set, and only attaches BasicNetworkCredential when falling back to username/password. Mixing the two would be redundant and could confuse some qBit middlewares.* ProcessRequest gains a fast path for the ApiKey case that skips AuthenticateClient (no cookie session needed) and routes 401/403 to DownloadClientAuthenticationException directly, matching the Radarr/Sonarr pattern.
Independent of pennydreadful#162: this change builds and works whether or not the auth-response-handling fix has landed yet. Users on classic username/password auth see no behavior change.
References:
https://github.com/Radarr/Radarr/blob/develop/src/NzbDrone.Core/Download/Clients/QBittorrent/QBittorrentSettings.cs
https://github.com/Radarr/Radarr/blob/develop/src/NzbDrone.Core/Download/Clients/QBittorrent/QBittorrentProxyV2.cs