Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Use opencode serve for a headless HTTP server or opencode web for the browser interface. Both bind to 127.0.0.1 by default, so they are local-only until you deliberately choose another hostname. For network access, bind to 0.0.0.0, set OPENCODE_SERVER_PASSWORD, and add only the browser origins that genuinely need cross-origin requests. The newer v2 CLI has a separate service and pairing workflow; do not treat its remote-pairing behavior as the defaults of the standalone server.

Choose the OpenCode mode before changing settings

OpenCode documents three related but distinct ways to provide access:

Mode Command or flow Default reachability Typical use
Standalone server opencode serve 127.0.0.1:4096 Headless HTTP service for an OpenCode client; exposes an OpenAPI endpoint at /doc
Browser interface opencode web 127.0.0.1 and an available port Opens the web application in the default browser
v2 service and pairing opencode pair, opencode pair --remote, and opencode service set Controlled through the v2 service configuration Pairing local or remote clients with time-limited links and persistent sessions

The first two rows describe the documented standalone server and web interface. The v2 CLI page describes a different service model, so port, authentication, remote-access prompts, and pairing lifetimes must be checked against the v2 behavior you are running.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What the standalone defaults mean

opencode serve

Run:

opencode serve

The documented defaults are port 4096, hostname 127.0.0.1, mDNS disabled, and no additional CORS origins. A process bound to 127.0.0.1 accepts requests from the same machine, not from other computers on the LAN. The server is headless and provides an OpenAPI description at /doc, which an OpenCode client can use to discover the HTTP API.

#1 Best Overall
Sale
Compressed Air Duster,130000RPM Super Power Cordless Air Duster,Rechargeable Brushless Blower,3 Gear Adjustable Blower with LED Light,Dust Remover for Computer/House/Outdoor/Car
  • Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
  • With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
  • Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
  • Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
  • Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.

opencode web

Run:

opencode web

The web command binds locally to 127.0.0.1, chooses an available port, and opens the application in the default browser. Because the port is selected at startup, do not assume that the web interface uses 4096; that fixed default belongs to the documented serve command.

Expose the server beyond the local machine

Bind to all network interfaces

To make the standalone server reachable through the machine’s network interfaces, pass a different hostname:

opencode serve --hostname 0.0.0.0

0.0.0.0 means the process listens on available interfaces rather than only on the loopback address. It does not itself provide encryption, identity, or access control. Before using it on a LAN or any routed network, enable a password and restrict access with the host firewall or network policy appropriate to your environment.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

LAN setup with HTTP Basic authentication

A practical command-line setup is:

OPENCODE_SERVER_PASSWORD='replace-with-a-secret' 
OPENCODE_SERVER_USERNAME='opencode' 
opencode serve --hostname 0.0.0.0

OPENCODE_SERVER_USERNAME is optional because the documented default username is opencode. Set it when you want a different login name. The password variable is the important control: OpenCode’s web documentation warns that if OPENCODE_SERVER_PASSWORD is absent, the server is unsecured. The same password setting applies when you start opencode web.

Use a secret that is not reused elsewhere. Environment variables can be exposed through shell history, process inspection, service definitions, or logs depending on how the process is launched, so use the secret-management method provided by your operating system or service manager for a persistent deployment.

Rank #2
EVEO® Screen Cleaner Spray Kit (Streak-Free) TV Screen Cleaner for Smart TV, Lcd, LEd, Oled | Computer Screen Cleaner Spray and Wipe Microfiber Cloth - TV, Monitor, Laptop, iPad, Car - 6.7oz 1 Pack
  • Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
  • Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
  • Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
  • Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
  • Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth

Configure settings in opencode.json

The web documentation shows server settings under a server object. For example:

{
  "server": {
    "port": 4096,
    "hostname": "0.0.0.0",
    "mdns": true,
    "cors": ["https://example.com"]
  }
}

Use the configuration file when the same settings should be applied repeatedly, such as a managed workstation or a service started by a supervisor. The documented web flow gives command-line flags precedence over values in the configuration file. That lets you keep a safe baseline in opencode.json and override a value for one invocation while diagnosing a problem.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Use port to select the listening port for the server configuration.
  • Use hostname to choose local-only binding or a network-facing binding.
  • Use mdns to enable multicast DNS discovery in configurations that support it.
  • Use cors as an array of permitted browser origins.

Keep the file’s hostname, password policy, and origin list aligned. A configuration that binds to 0.0.0.0 but omits a password is network-accessible without the documented HTTP Basic protection.

Set HTTP Basic authentication correctly

Required variable

Set OPENCODE_SERVER_PASSWORD before launching the server or web interface:

export OPENCODE_SERVER_PASSWORD='replace-with-a-secret'
opencode serve

OpenCode uses HTTP Basic authentication when this password is configured. If you do not set a username, clients should use the documented default, opencode.

Rank #3
Sale
BladeHawks RGB Gaming Mouse Pad Extra Large Extended 31.5x12 Inch-Black | LED mouse pad with 14 lighting modes, covers keyboard & mouse, anti-slip rubber base, waterproof surface, USB powered
  • 【Large size】:Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
  • 【LED backlight mouse pad】:Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
  • 【Anti-slip rubber base】:Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
  • 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
  • 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.

Optional username override

export OPENCODE_SERVER_USERNAME='my-user'
export OPENCODE_SERVER_PASSWORD='replace-with-a-secret'
opencode serve

The username variable changes the login name; it does not replace the password requirement. Authentication and network binding are separate settings: a localhost-only server can still require a password, while a network-bound server should not be left without one.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Changing a password in the v2 service flow

The v2 CLI documentation states that changing the server password signs every existing session out. Plan a password change as an intentional access reset, especially when several clients or users are paired. Clients must authenticate again after the change.

Allow browser origins with CORS

When CORS is needed

CORS is a browser permission mechanism. Add an origin when a web application is loaded from a different origin than the OpenCode server and must call that server from JavaScript. An origin includes the scheme, host, and port, so http://localhost:5173 and https://localhost:5173 are different origins.

CORS does not make a server reachable from another machine, and it does not authenticate users. You still need the correct hostname binding for network access and the password variable for HTTP Basic authentication.

Add origins on the command line

Repeat the --cors option for multiple origins:

opencode serve 
  --cors http://localhost:5173 
  --cors https://app.example.com

List only the exact origins required by your browser client. Do not add a broad or unneeded origin simply to make an error disappear; an origin on this list is allowed to issue browser requests to the server.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
Sale
Vaydeer Wrist Rest for Keyboard and Mouse, Computer Ergonomic Wrist Support Pad, Soft Memory Foam Arm Cushion for Desk, Palm Hand Office Laptop Typing
  • 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
  • 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
  • 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
  • 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
  • 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.

Add origins in the configuration file

{
  "server": {
    "cors": [
      "http://localhost:5173",
      "https://app.example.com"
    ]
  }
}

Use the array form when the origins are stable. If you provide --cors flags at launch, the documented precedence rule means those command-line values take priority over the file’s server settings. Check the actual command used by a service manager before editing the file; an unnoticed flag can make a file change appear ineffective.

Use mDNS for local discovery

The web interface supports mDNS discovery from the command line:

opencode web --mdns

According to the web documentation, enabling mDNS automatically changes the hostname to 0.0.0.0 and advertises the service as opencode.local. A custom mDNS domain can be supplied with --mdns-domain.

Because mDNS both changes the binding and advertises a discoverable name, treat --mdns as a network-access decision rather than merely a convenience switch. Use it on a trusted local network, keep password authentication enabled, and remember that discovery does not replace authentication.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Understand v2 pairing and remote access

Local and remote pairing commands

The current v2 CLI documentation describes:

opencode pair
opencode pair --remote

opencode pair handles local pairing. The --remote form is for remote access. On first use, the remote flow prompts for confirmation before exposing the server to the internet, and the documentation says access requires the server password.

Best Value
Sale
Under Desk Cable Management Tray No Drill, Metal Mesh Cable Management Under Desk with Clamp Mount, 2 Hole Cable Tray with Wire Management and Cord Organizer for Home Office Standing Desk
  • 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
  • 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
  • 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
  • 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
  • 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.

Pair-link and session lifetimes

A pairing link works once and expires after five minutes. After a successful pairing, the paired session lasts 30 days. These are v2 product behaviors, not general defaults for opencode serve or opencode web. A password change signs every session out, so it also invalidates existing paired access.

Change v2 service settings

The v2 flow provides opencode service set for changing service properties such as hostname, port, password, and CORS. Use that command when operating the v2 background service rather than assuming that a standalone-server command or an opencode.json value controls the service in the same way.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Choose a configuration by access requirement

Requirement Recommended configuration Important checks
Only the same computer needs access opencode serve with the default 127.0.0.1 binding, or opencode web No network binding is required; add a password if you want authentication even for local clients
A browser client runs on another local origin Keep the appropriate server binding and add that exact origin with repeated --cors flags or the server.cors array CORS is not authentication; retain the password
Another computer on the LAN needs access Bind with --hostname 0.0.0.0, set OPENCODE_SERVER_PASSWORD, and allow only required origins Check firewall rules and verify the client uses the server’s reachable address and port
Users should discover a service locally Use opencode web --mdns or the corresponding mDNS configuration mDNS changes the binding to 0.0.0.0 and advertises opencode.local; use it only on a trusted network
Remote access through the v2 workflow Use opencode pair --remote and configure the v2 service with opencode service set Confirm the first internet-exposure prompt, use the server password, and account for five-minute link and 30-day session limits

Verify a setup without accidentally widening access

  1. Start with the narrowest binding that meets the requirement. Use the default loopback address for local-only work.
  2. Set OPENCODE_SERVER_PASSWORD before changing the hostname to 0.0.0.0.
  3. Choose a fixed port for serve when clients or firewall rules need a predictable endpoint. Do not infer the web interface’s port from the server default.
  4. Add each required browser origin exactly, including its scheme and port. Avoid adding origins that are not used.
  5. Start the process and confirm that the expected command-line flags are present. A flag can override a value in opencode.json.
  6. From the client machine, test the chosen address and port. From a browser client, inspect the browser’s network error and the request’s Origin value when diagnosing CORS.
  7. Open the server’s /doc endpoint when you need to confirm that the headless API is responding.
  8. If using mDNS, test the advertised opencode.local name from a device on the same network and confirm that password authentication is still enabled.

Troubleshoot common failures

Another computer cannot connect

  • Confirm the process is not still bound only to 127.0.0.1; use --hostname 0.0.0.0 or the corresponding configuration.
  • Confirm the client is using the host’s reachable IP address and the configured port, not the client’s own localhost address.
  • Check the operating-system firewall and any network isolation on the LAN.
  • If the process was launched with a command-line hostname or port, remember that the flag takes precedence over the configuration file.

The browser reports a CORS error

  • Read the browser request’s exact origin, including scheme and port.
  • Add that origin with --cors or in server.cors.
  • When using multiple command-line origins, repeat --cors for each one.
  • Restart the process after changing startup flags or the configuration file.
  • Do not remove password authentication as a CORS workaround; the two controls solve different problems.

Authentication fails

  • Verify that OPENCODE_SERVER_PASSWORD is present in the environment of the running process, not only in an interactive shell where the service cannot see it.
  • Use the default username opencode unless OPENCODE_SERVER_USERNAME was set to another value.
  • Check for shell quoting errors or accidental whitespace in the secret.
  • In v2, reauthenticate after a password change because existing sessions are signed out.

mDNS does not work as expected

  • Remember that --mdns changes the hostname to 0.0.0.0; it is not a loopback-only mode.
  • Confirm that the client and server are on a network that permits multicast DNS traffic.
  • Try the advertised opencode.local name, or the custom domain supplied through --mdns-domain.
  • Use the server’s IP address to separate an mDNS discovery problem from a server or firewall problem.

A configuration-file change appears to do nothing

Inspect the launch command first. The documented web configuration gives command-line settings priority over opencode.json. Remove or update the conflicting flag, restart the process, and then test the effective hostname, port, and CORS behavior.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Security checklist for network use

  • Set OPENCODE_SERVER_PASSWORD before exposing a service beyond localhost.
  • Change OPENCODE_SERVER_USERNAME only when a non-default login name is useful; the username is not a substitute for a strong password.
  • Bind to 127.0.0.1 unless another device genuinely needs access.
  • When network access is required, use 0.0.0.0 deliberately and constrain reachability with firewall or network controls.
  • Allow only the browser origins that are required, and distinguish CORS permission from authentication.
  • Use mDNS only on a trusted local network because it both advertises a name and enables a network-facing binding.
  • For v2 remote pairing, review the internet-exposure confirmation, protect the server password, and expect one-time five-minute links and 30-day paired sessions.
  • After changing a v2 password, reconnect every client because all existing sessions are invalidated.

Key distinctions to keep straight

Access scope: 127.0.0.1 is local-only; 0.0.0.0 listens on network interfaces.

Process mode: serve is the headless HTTP server, web launches the browser interface, and v2 pairing belongs to the separate service workflow.

Authentication: OPENCODE_SERVER_PASSWORD enables the documented password protection, while OPENCODE_SERVER_USERNAME optionally changes the username.

Browser permission: CORS lists permitted origins; it does not expose a localhost-only process and does not replace authentication.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Configuration precedence: in the documented web flow, command-line flags override values in opencode.json.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.