Basic HTTP authentication

[Kabouik]

Thanks for Matedroid!

I cannot use it yet because my Teslamate and Teslamate Grafana subdomains require basic HTTP authentication, so the Teslamate API token is not enough to access the dashboards and data. I assume many users who have their Teslamate under a public URL will also have basic HTTP authentication for security. It would be great if you could add support for that.

[vide]

Hello! There is a sister issue (in Spanish sorry 😅 ) #11. Like in that case, I need to rethink the layout of the Settings page because it will become more and more crowded.
Also I would strongly suggest using a VPN solution (Wireguard, Tailscale, ZeroTier etc) instead of exposing the TM API over the Internet.

[Kabouik]

Thanks, I'll watch both those issues then. Don't you think that HTTP Basic Auth using the webserver (both for the main Teslamate landing page and the Grafana interface), in addition to the Grafana authentication are enough when using a reverse proxy to a domain?

…

On January 11, 2026 5:44:58 PM GMT+01:00, Davide Ferrari ***@***.***> wrote: vide left a comment (vide/matedroid#36) Hello! There is a sister issue (in Spanish sorry 😅 ) #11. Like in that case, I need to rethink the layout of the Settings page because it will become more and more crowded. Also I would strongly suggest using a VPN solution (Wirguard, Tailscale, ZeroTier etc) instead of exposing the TM API over the Internet.

[scresp0]

Basic auth would be great for Internet exposure.

Thanks

[Alain-DEPUILLE-WDFR]

I'd love a basic auth for MateDroid. I'd prefer be able to run MateDroid without running a VPN first.

I was quite shocked to learn that the API Token was not implemented in all routes in teslamate-api, I don't get why, but it's another debate...

[p4block]

This fork has vibe coded support for basic-auth and other small fixes. It can confirm it's working.

Slapping basic-auth with a reverse proxy in front of Teslamate is how it's usually deployed it, the app should support it

[Alain-DEPUILLE-WDFR]

This fork has vibe coded support for basic-auth and other small fixes. It can confirm it's working.

Works great for me too

[Kabouik]

Are there any built releases for this fork or did you build it yourselves?

[frederik-smrthme]

For anyone who wants to properly secure TeslaMateApi but runs into limitations because MateDroid does not support HTTP Basic Auth:

A simple and practical workaround is:

• Do not use Basic Auth.
• Configure your reverse proxy to allow access to "/api/*" only if the request contains a specific
  "Authorization: Bearer <YOUR_TOKEN>" header".

This way, the entire API remains protected from unauthenticated access, while staying fully compatible with MateDroid’s token-based authentication model.

If you want a reasonably secure public setup (without VPN) and cannot rely on Basic Auth due to client limitations, this approach works quite well as a lightweight alternative.