What app is this about, and its version: Readeck 0.22.3 / KOReader (v2026.03)
What YunoHost version are you running: YunoHost 12.1.40.1 (stable)
What type of hardware are you using: Raspberry Pi 3, 4+
Describe your issue
I’m trying to use the Readeck OPDS catalog with KOReader (v2026.03)
According to the Readeck documentation, KOReader should be configured as follows:
URL: https://sub.domain.tld/opds
Username: <USERNAME>
Password: <API_TOKEN>
However, KOReader always fails to authenticate. To troubleshoot this, I tested the endpoint with curl. Using Basic Authentication with username + API token
(curl -v -u <USERNAME>:<API_TOKEN> https://sub.domain.tld/opds)
returns:
< HTTP/2 401
...
* Basic authentication problem, ignoring.
< www-authenticate: Basic realm="Readeck Authentication"
< www-authenticate: Bearer realm="Bearer token"
The same happens for curl -v -u <USERNAME>:<API_TOKEN> https://sub.domain.tld/api/bookmarks
However, using the same API token as a Bearer token works perfectly:
curl -v -H "Authorization: Bearer <API_TOKEN>" https://sub.domain.tld/opds
returns:
< HTTP/2 200
...
< content-type: application/atom+xml; profile=opds-catalog; kind=navigation
and curl -H "Authorization: Bearer <API_TOKEN>" https://sub.domain.tld/api/bookmarks returns the expected JSON response.
So:
Basic Authentication (USERNAME:API_TOKEN) →
HTTP/2 401
Bearer Authentication (Authorization: Bearer API_TOKEN) →HTTP/2 200
KOReader only provides fields for URL, username and password, so it cannot send a Bearer token. Every response also contains:
x-sso-wat: You've just been SSOed
Has anyone successfully configured KOReader with the YunoHost Readeck package?
Best regards,
Christian
Share relevant logs or error messages
Basic Authentication
(curl -v -u <USERNAME>:<API_TOKEN> https://sub.domain.tld/opds)
< HTTP/2 401
< server: nginx
< date: Tue, 28 Jul 2026 20:26:01 GMT
< content-type: text/plain; charset=utf-8
< content-length: 12
< x-sso-wat: You've just been SSOed
< cache-control: private
< content-security-policy: upgrade-insecure-requests
< permissions-policy: interest-cohort=()
< referrer-policy: same-origin, strict-origin
< set-cookie: sxid=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; HttpOnly; Secure; SameSite=Lax
< vary: Accept-Encoding
< vary: Accept
* Basic authentication problem, ignoring.
< www-authenticate: Basic realm="Readeck Authentication"
< www-authenticate: Bearer realm="Bearer token"
< x-content-type-options: nosniff
< x-frame-options: SAMEORIGIN
< x-robots-tag: noindex, nofollow, noarchive
< x-xss-protection: 1; mode=block
< x-download-options: noopen
< x-permitted-cross-domain-policies: none
< strict-transport-security: max-age=63072000; includeSubDomains; preload
<
* Connection #0 to host <sub.domain.tld>:443 left intact
Bearer Authentication
(curl -v -H "Authorization: Bearer <API_TOKEN>" https://sub.domain.tld/opds)
< HTTP/2 200
...
< content-type: application/atom+xml; profile=opds-catalog; kind=navigation