[bug] v2 self-host: MCP OAuth fails over LAN HTTP: issuer mismatch #2330

Executor version

2.0.0-beta.25

How do you run Executor?

Self-host (Docker)

Operating system

Linux

Integration involved

MCP OAuth / OpenCode

What happened

Connecting OpenCode to my self-hosted Executor over LAN HTTP fails with an OAuth issuer mismatch. MCP discovery advertises http://<LAN-IP>:4788/api/auth, but the authorization-server metadata returns https://<LAN-IP>:4788/api/auth. I’m not using HTTPS or a reverse proxy.

Suspected cause:
Better Auth’s validateIssuerUrl silently changes non-loopback HTTP issuers to HTTPS. Executor’s other discovery metadata retains HTTP.

This matches upstream better-auth/better-auth#11740.

What you expected

MCP OAuth should work with the configured LAN HTTP origin.

Please track the upstream issue and update the affected Better Auth dependency once a compatible fix is released.

Steps to reproduce

Run the stock Docker image with these settings and no custom Better Auth configuration. Replace <LAN-IP> with the server’s private IP:

environment:
  - BETTER_AUTH_URL=http://<LAN-IP>:4788
  - EXECUTOR_URL_ALLOW_HTTP_ORIGINS=["http://<LAN-IP>:4788"]

Connect OpenCode to http://<LAN-IP>:4788/mcp using OAuth.

1. Executor’s MCP discovery advertises http://<LAN-IP>:4788/api/auth as the authorization server.
2. That server’s discovery document returns https://<LAN-IP>:4788/api/auth as its issuer.
3. OpenCode rejects the mismatch.

Diagnostics / logs

Issuer mismatch in authorization server metadata:
expected "http://<LAN-IP>:4788/api/auth"
received "https://<LAN-IP>:4788/api/auth"

Before you submit

• I searched the open issues for a duplicate.
• I removed all keys, tokens, and credentials from this report.