When entering the token in the web UI, login fails with "Failed to fetch".

[Zoean-z]

What version of HAPI is running?

0.16.1

What platform is your computer?

No response

What issue are you seeing?

When entering the token in the web UI, login fails with "Failed to fetch".

Browser console shows a CORS error:

Access to fetch at 'https://app.run/api/auth' from origin 'https://app.hapi.run'
has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present.
POST https://app.run/api/auth net::ERR_FAILED

It seems the frontend is sending the auth request to https://app.run/api/auth, which causes a CORS failure.

What steps can reproduce the bug?

Start HAPI hub

Open the web UI

Enter the token on the login page

Login fails and the browser console shows the CORS error above

What is the expected behavior?

No response

Additional information

No response

[github-actions]

Thanks for the report. Based on the current source, this looks more like the web app is using a saved/custom hub origin of https://app.run, not that /api/auth is hardcoded there.

I checked the current code path for browser login:

• the auth request is sent to fetch(this.buildUrl('/api/auth')) in web/src/api/client.ts:125
• baseUrl comes from the selected hub URL, or falls back to window.location.origin if no hub override is set in web/src/hooks/useServerUrl.ts:79 and web/src/hooks/useServerUrl.ts:89
• the login UI exposes that hub override in the top-right Hub dialog, with a Use same origin action in web/src/components/LoginPrompt.tsx:174 and web/src/components/LoginPrompt.tsx:215

I also searched the repo for app.run and did not find a hardcoded https://app.run target. In relay mode, the hub defaults the official web app URL to https://app.hapi.run, not https://app.run (hub/src/index.ts:114, hub/src/web/server.ts:103).

If you are hosting the web app on a different origin than the hub, the hub must allow that origin via CORS. Current hub config derives default CORS origins from HAPI_PUBLIC_URL, or you can set CORS_ORIGINS explicitly (hub/src/config/serverSettings.ts:169, hub/src/config/serverSettings.ts:190, hub/src/web/server.ts:76, hub/README.md:25, hub/README.md:247).

Relevant code:

• web/src/api/client.ts:125 - auth POST goes to buildUrl('/api/auth')
• web/src/hooks/useServerUrl.ts:79 - hub URL can come from URL params or localStorage
• web/src/hooks/useServerUrl.ts:89 - fallback is current page origin
• web/src/components/LoginPrompt.tsx:174 - login screen Hub picker
• web/src/components/LoginPrompt.tsx:215 - Use same origin button
• hub/src/index.ts:114 - relay-mode official web URL default is https://app.hapi.run
• hub/src/config/serverSettings.ts:190 - CORS origins come from CORS_ORIGINS or HAPI_PUBLIC_URL

Need more info:

• What is the exact login page URL before submitting the token? Please include whether it has a ?hub= query param.
• In the login page Hub dialog, does it show a custom hub, and does Use same origin change the behavior?
• What is the value of localStorage['hapi_hub_url'] in that browser?
• Are you running the hub with --relay, and what are your HAPI_PUBLIC_URL / CORS_ORIGINS settings?

---

HAPI Bot