Upgrading from Anthias 0.20.5 or earlier switches off the web interface password

If you turned on authentication on Anthias 0.20.5 or earlier, the web interface stops asking for a password once you upgrade to 2026.05.0. Set a new password right after the upgrade.

Anthias 2026.05.0 keeps the username and password in the player's database instead of in the [auth_basic] section of the config file. Anthias 0.20.5 and earlier saved the password in a format the new sign-in can't read, and it can't be converted without the password itself. So when the upgrade finds one, it removes the [auth_basic] section from ~/.anthias/anthias.conf, switches authentication off and logs this line, which you can read with journalctl -t anthias-server:

Insecure password hash in /data/.anthias/anthias.conf; clearing credentials and disabling basic auth. Re-set the password from the Settings page.

If you turned on authentication on Anthias 0.20.5 or earlier: after upgrading, open Settings, go to "Authentication", choose "Basic auth" under "Method", enter a username and a new password, and select "Save settings". Until you do, anyone who can reach the player on your network can use the web interface.

The new password has to be at least 8 characters, can't be a commonly used password or only numbers, and can't be too close to the username.

If authentication was off before the upgrade, it stays off. Any username and password left in the config file are removed, so you choose new ones when you turn it on.

For developers

Scripts that call the API with HTTP Basic credentials keep working with the new username and password. Each use is logged as a DEPRECATED warning, at most once an hour for each user, client address and path, and the warning says HTTP Basic will be removed in a future release.