diff --git a/packages/app/src/context/global-sdk.tsx b/packages/app/src/context/global-sdk.tsx
index af4bbdccc..5708fe92f 100644
--- a/packages/app/src/context/global-sdk.tsx
+++ b/packages/app/src/context/global-sdk.tsx
@@ -11,6 +11,7 @@ export const { use: useGlobalSDK, provider: GlobalSDKProvider } = createSimpleCo
     const server = useServer()
     const platform = usePlatform()
     const abort = new AbortController()
+    const password = window.__OPENCODE__?.serverPassword
 
     // Prefer the WebView fetch implementation for streaming responses.
     // @tauri-apps/plugin-http 2.5.x has known issues with streaming/cancellation that can
@@ -18,6 +19,11 @@ export const { use: useGlobalSDK, provider: GlobalSDKProvider } = createSimpleCo
     const eventSdk = createOpencodeClient({
       baseUrl: server.url,
       signal: abort.signal,
+      headers: password
+        ? {
+            Authorization: `Basic ${btoa(`opencode:${password}`)}`,
+          }
+        : undefined,
     })
     const emitter = createGlobalEmitter<{
       [key: string]: Event