diff --git a/index.ts b/index.ts
index 4cd77603..fc8ab62a 100644
--- a/index.ts
+++ b/index.ts
@@ -8,6 +8,7 @@ import {
     createCommandExecuteHandler,
     createSystemPromptHandler,
 } from "./lib/hooks"
+import { configureClientAuth, isSecureMode } from "./lib/auth"
 
 const plugin: Plugin = (async (ctx) => {
     const config = getConfig(ctx)
@@ -19,6 +20,11 @@ const plugin: Plugin = (async (ctx) => {
     const logger = new Logger(config.debug)
     const state = createSessionState()
 
+    if (isSecureMode()) {
+        configureClientAuth(ctx.client)
+        // logger.info("Secure mode detected, configured client authentication")
+    }
+
     logger.info("DCP initialized", {
         strategies: config.strategies,
     })
diff --git a/lib/auth.ts b/lib/auth.ts
new file mode 100644
index 00000000..8b7aa418
--- /dev/null
+++ b/lib/auth.ts
@@ -0,0 +1,37 @@
+export function isSecureMode(): boolean {
+    return !!process.env.OPENCODE_SERVER_PASSWORD
+}
+
+export function getAuthorizationHeader(): string | undefined {
+    const password = process.env.OPENCODE_SERVER_PASSWORD
+    if (!password) return undefined
+
+    const username = process.env.OPENCODE_SERVER_USERNAME ?? "opencode"
+    // Use Buffer for Node.js base64 encoding (btoa may not be available in all Node versions)
+    const credentials = Buffer.from(`${username}:${password}`).toString("base64")
+    return `Basic ${credentials}`
+}
+
+export function configureClientAuth(client: any): any {
+    const authHeader = getAuthorizationHeader()
+
+    if (!authHeader) {
+        return client
+    }
+
+    // The SDK client has an internal client with request interceptors
+    // Access the underlying client to add the interceptor
+    const innerClient = client._client || client.client
+
+    if (innerClient?.interceptors?.request) {
+        innerClient.interceptors.request.use((request: Request) => {
+            // Only add auth header if not already present
+            if (!request.headers.has("Authorization")) {
+                request.headers.set("Authorization", authHeader)
+            }
+            return request
+        })
+    }
+
+    return client
+}