When key.txt is empty: headscale-webui serves a redirect loop on whichever page. When key.txt is missing: the console reports the lack of key; the browser is continuously redirected to /prefix/settings, even when on /prefix/settings.
Replication
Delete key.txt
or
Empty key.txt
Tested conditions
With OIDC auth
With BASIC auth
User mitigation
Use the python console to manually encode the api key.
from cryptography.fernet import Fernet
fernet = Fernet("SECRET")
encrypted_key = fernet.encrypt("KEY".encode())
Observation
When key.txt is empty: headscale-webui serves a redirect loop on whichever page. When key.txt is missing: the console reports the lack of key; the browser is continuously redirected to /prefix/settings, even when on /prefix/settings.
Replication
Tested conditions
User mitigation
Use the python console to manually encode the api key.
Insert result without the begining b' and end '.