Headplane/headscale behind npmplus cannot authorize api key

[Fordwrench]

Description

I have headscale/headplane behind nginx proxy manager. I am running it in a debain 12 lxc with docker. I cannot validate api key. I get the following error in headplane logs.

Error while validating API key: SyntaxError: Unexpected token '<', "
<h"... is not valid JSON

https://pastebin.com/73YJPuwT - docker compose yaml
https://pastebin.com/CFKXtW8R - headplane config
https://pastebin.com/Ud6P8MTx - headscale config

Headplane Version

0.6.0

Headscale Version

0.26.0

[BobWs]

Having the exact same problem! Can not login into the admin page of headplane using URL with subdomain or IP, nothing works!

2025-07-05T07:53:42.309Z [auth] ERROR: Error while validating API key: DataWithResponseInit {
  type: 'DataWithResponseInit',
  data: 'The Headscale API is not reachable',
  init: [Object]
}

Anyone found a solution?

[elsatim]

Having the exact same problem! Can not login into the admin page of headplane using URL with subdomain or IP, nothing works!

2025-07-05T07:53:42.309Z [auth] ERROR: Error while validating API key: DataWithResponseInit {
  type: 'DataWithResponseInit',
  data: 'The Headscale API is not reachable',
  init: [Object]
}

Anyone found a solution?

I had the same issue, to resolve it in the headplane config I had to set the "URL" entry to the address for headscale server.
In NPM I had to create a custom location under the headscale proxy for "/" with the following in advanced.

# CORS-Handling für OPTIONS-Preflight-Requests
    if ($request_method = OPTIONS) {
        add_header 'Access-Control-Allow-Origin' 'http://headplane-ui' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, User-Agent' always;
        add_header 'Access-Control-Expose-Headers' 'Content-Length, Content-Range' always;
        add_header 'Content-Length' 0 always;
        add_header 'Content-Type' 'text/plain; charset=utf-8' always;
        return 204;
    }

    # CORS-Header für alle anderen Requests
    add_header 'Access-Control-Allow-Origin' 'http://headplane-ui' always;
    add_header 'Access-Control-Allow-Methods' 'GET, POST, DELETE, OPTIONS' always;
    add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, User-Agent' always;
    add_header 'Access-Control-Expose-Headers' 'Content-Length, Content-Range' always;

It solved your issue but still leaves me with the error authenticating token from @Fordwrench

[tale]

Unfortunately I can't really say much, do debug logs give you any other information? I know with tokens its entirely related to CORS and when running in a reverse proxy, websites make it very silly. Other things are to make sure cookie_secure is set to true when running behind NPM