[Bug]: Node.js API authentication fails with "Invalid redirect URL" when OpenID is configured alongside password auth

What happened?

When OpenID is configured via environment variables (ACTUAL_OPENID_*) and ACTUAL_LOGIN_METHOD=password + ACTUAL_ALLOWED_LOGIN_METHODS=password,openid are set to allow both methods, the Node.js API (@actual-app/api) fails to authenticate with password, returning Authentication failed: Invalid redirect URL.

How can we reproduce the issue?

1. Configure OpenID via env vars (ACTUAL_OPENID_DISCOVERY_URL, ACTUAL_OPENID_CLIENT_ID, etc.)
2. Add ACTUAL_LOGIN_METHOD=password and ACTUAL_ALLOWED_LOGIN_METHODS=password,openid
3. Also add ACTUAL_OPENID_ENFORCE=false
4. Try to authenticate using the Node.js API with api.init({ serverURL, password })

Expected behavior: Password authentication should work as a fallback when ACTUAL_OPENID_ENFORCE=false and allowedLoginMethods includes password.

Actual behavior: The server returns Authentication failed: Invalid redirect URL — the OpenID redirect flow is triggered even when explicitly requesting password auth via the Node.js API.

Workaround: Remove all ACTUAL_OPENID_* env vars. The budget then becomes inaccessible because it was created under the OpenID user. The only working solution found was to disable OpenID entirely.

Where are you hosting Actual?

Docker

What browsers are you seeing the problem on?

Chrome

Operating System

Windows 11