DTK0008: Client Auth Disabled

Message

Client authentication is disabled. Any browser can connect to the devtools and access your server and filesystem.

Cause

This warning is emitted when the DevTools hub starts and client authentication has been fully disabled. Authentication is disabled when either of the following is true:

1. The Vite config sets devtools.config.clientAuth to false.
2. The environment variable VITE_DEVTOOLS_DISABLE_CLIENT_AUTH is set to 'true'.

When authentication is disabled, every connecting WebSocket client is automatically marked as trusted (meta.isTrusted = true), bypassing the token-based auth flow entirely.

Build mode does not disable authentication: the standalone build viewer keeps the auth gate installed and trusts clients via an unguessable per-process capability token baked into the locally-served connection metadata. The zero-prompt UX is preserved without trusting arbitrary clients.

Example

import devtools from '@vitejs/devtools'
// vite.config.ts
import { defineConfig } from 'vite'

export default defineConfig({
  plugins: [
    devtools({
      config: {
        // This disables client auth and triggers DTK0008
        clientAuth: false,
      },
    }),
  ],
})

Or via environment variable:

VITE_DEVTOOLS_DISABLE_CLIENT_AUTH=true vite dev

Fix

This is an informational warning. No action is required if you intentionally disabled authentication (e.g., in a trusted local environment).

If this warning is unexpected:

• Remove clientAuth: false from your devtools.config in vite.config.ts.
• Unset the VITE_DEVTOOLS_DISABLE_CLIENT_AUTH environment variable.

Source

• packages/core/src/node/auth-handler.ts — isClientAuthDisabled() reports when the auth gate is bypassed (clientAuth: false or VITE_DEVTOOLS_DISABLE_CLIENT_AUTH=true).