diff --git a/bot.py b/bot.py
index cd30f9a..3c7493f 100644
--- a/bot.py
+++ b/bot.py
@@ -25,6 +25,8 @@ logging.basicConfig(
 logger = logging.getLogger(__name__)
 
 OPENCODE_API_URL = os.getenv("OPENCODE_API_URL", "http://127.0.0.1:4096")
+OPENCODE_SERVER_USERNAME = os.getenv("OPENCODE_SERVER_USERNAME", "opencode")
+OPENCODE_SERVER_PASSWORD = os.getenv("OPENCODE_SERVER_PASSWORD")
 BOT_TOKEN = os.getenv("TELEGRAM_BOT_TOKEN")
 ALLOWED_CHAT_ID = os.getenv("TELEGRAM_ALLOWED_CHAT_ID")
 
@@ -47,7 +49,13 @@ def get_session():
     if SESSION_ID:
         return SESSION_ID
     try:
-        r = requests.get(f"{OPENCODE_API_URL}/session", timeout=10)
+        r = requests.get(
+            f"{OPENCODE_API_URL}/session",
+            timeout=10,
+            auth=(OPENCODE_SERVER_USERNAME, OPENCODE_SERVER_PASSWORD)
+            if OPENCODE_SERVER_PASSWORD
+            else None,
+        )
         if r.ok:
             sessions = r.json()
             if sessions:
@@ -56,7 +64,14 @@ def get_session():
     except Exception:
         logger.exception("Failed to fetch existing sessions")
     try:
-        r = requests.post(f"{OPENCODE_API_URL}/session", json={}, timeout=10)
+        r = requests.post(
+            f"{OPENCODE_API_URL}/session",
+            json={},
+            timeout=10,
+            auth=(OPENCODE_SERVER_USERNAME, OPENCODE_SERVER_PASSWORD)
+            if OPENCODE_SERVER_PASSWORD
+            else None,
+        )
         if r.ok:
             SESSION_ID = r.json()["id"]
             return SESSION_ID
@@ -76,6 +91,9 @@ def send_to_opencode(message):
             f"{OPENCODE_API_URL}/session/{session_id}/message",
             json={"parts": [{"type": "text", "text": f"[Telegram] {message}"}]},
             timeout=1200,
+            auth=(OPENCODE_SERVER_USERNAME, OPENCODE_SERVER_PASSWORD)
+            if OPENCODE_SERVER_PASSWORD
+            else None,
         )
         if r.ok:
             data = r.json()
@@ -128,7 +146,13 @@ async def status_command(update: Update, context: ContextTypes.DEFAULT_TYPE):
     if not is_authorized(update):
         return
     try:
-        r = requests.get(f"{OPENCODE_API_URL}/global/health", timeout=5)
+        r = requests.get(
+            f"{OPENCODE_API_URL}/global/health",
+            timeout=5,
+            auth=(OPENCODE_SERVER_USERNAME, OPENCODE_SERVER_PASSWORD)
+            if OPENCODE_SERVER_PASSWORD
+            else None,
+        )
         healthy = r.ok
     except Exception:
         healthy = False