the TUI doesn't allow me to login, even if my email and passwords are correct.

[Dexmachi]

Steps to get to the problem:

• install bitty
• run bitty
• try to login with the correct server and credentials (the same as in bitwarden's website)
• fail

is there something im missing?
I usually am kinda bad with tuis, but idk

[Dexmachi]

Im the worst at coding in TS, but running with some debug flags, this was spilled out:

NODE_DEBUG=http,https NODE_TLS_REJECT_UNAUTHORIZED=0 bitty
HTTP 48231: createConnection vault.bitwarden.com:443:::::::::::::::::::::
HTTPS 48231: createConnection [Object: null prototype] {
hostname: 'vault.bitwarden.com',
path: null,
method: 'POST',
headers: { 'Content-Type': 'application/json' },
_defaultAgent: Agent {
_events: [Object: null prototype] {
free: [Function (anonymous)],
newListener: [Function: maybeEnableKeylog]
},
_eventsCount: 2,
_maxListeners: undefined,
options: [Object: null prototype] {
keepAlive: true,
scheduling: 'lifo',
timeout: 5000,
proxyEnv: undefined,
defaultPort: 443,
protocol: 'https:',
noDelay: true,
path: null
},
defaultPort: 443,
protocol: 'https:',
requests: [Object: null prototype] {},
sockets: [Object: null prototype] {
'vault.bitwarden.com:443:::::::::::::::::::::': []
},
freeSockets: [Object: null prototype] {},
keepAliveMsecs: 1000,
keepAlive: true,
(node:48231) Warning: Setting the NODE_DEBUG environment variable to 'http' can expose sensitive data (such as passwords, tokens and authentication headers) in the resulting log.
(Use node --trace-warnings ... to show where the warning was created)
(node:48231) Warning: Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests insecure by disabling certificate verification.

[Dexmachi]

found the glitch:

󰘧 curl -v -X POST https://vault.bitwarden.com/api/accounts/prelogin
-H "Content-Type: application/json"
-H "Device-Type: 8"
-d '{"email":"myemail@gmail.com"}'
Note: Unnecessary use of -X or --request, POST is already inferred.

• Host vault.bitwarden.com:443 was resolved.
• IPv6: 2a04:4e42:4c::347, 2a04:4e42:4d::347
• IPv4: 199.232.197.91, 199.232.193.91
• Trying [2a04:4e42:4c::347]:443...
• Trying 199.232.197.91:443...
• ALPN: curl offers h2,http/1.1
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• SSL Trust Anchors:
• CAfile: /etc/ssl/certs/ca-certificates.crt
• TLSv1.3 (IN), TLS handshake, Server hello (2):
• TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
• TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
• TLSv1.3 (IN), TLS handshake, Certificate (11):
• TLSv1.3 (IN), TLS handshake, CERT verify (15):
• TLSv1.3 (IN), TLS handshake, Finished (20):
• TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
• TLSv1.3 (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519MLKEM768 / RSASSA-PSS
• ALPN: server accepted h2
• Server certificate:
• subject: CN=vault.bitwarden.com
• start date: Nov 2 11:12:54 2025 GMT
• expire date: Jan 31 11:12:53 2026 GMT
• issuer: C=US; O=Let's Encrypt; CN=R12
• Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
• Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
• Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
• subjectAltName: "vault.bitwarden.com" matches cert's "vault.bitwarden.com"
• SSL certificate verified via OpenSSL.
• Established connection to vault.bitwarden.com (2a04:4e42:4c::347 port 443) from 2804:79c8:219:e100:9ba4:fa04:264d:96fa port 54020
• using HTTP/2
• [HTTP/2] [1] OPENED stream for https://vault.bitwarden.com/api/accounts/prelogin
• [HTTP/2] [1] [:method: POST]
• [HTTP/2] [1] [:scheme: https]
• [HTTP/2] [1] [:authority: vault.bitwarden.com]
• [HTTP/2] [1] [:path: /api/accounts/prelogin]
• [HTTP/2] [1] [user-agent: curl/8.17.0]
• [HTTP/2] [1] [accept: /]
• [HTTP/2] [1] [content-type: application/json]
• [HTTP/2] [1] [device-type: 8]
• [HTTP/2] [1] [content-length: 32]

POST /api/accounts/prelogin HTTP/2
Host: vault.bitwarden.com
User-Agent: curl/8.17.0
Accept: /
Content-Type: application/json
Device-Type: 8
Content-Length: 32

• upload completely sent off: 32 bytes
• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
  < HTTP/2 404
  < accept-ranges: bytes
  < x-xss-protection: 1; mode=block
  < x-content-type-options: nosniff
  < x-frame-options: SAMEORIGIN
  < x-rate-limit-limit: 1m
  < x-rate-limit-remaining: 8
  < x-rate-limit-reset: 2025-12-26T19:28:00.0000000Z
  < date: Fri, 26 Dec 2025 19:27:26 GMT
  < x-url-path: /api/accounts/prelogin
  < strict-transport-security: max-age=31536000
  < content-length: 0
  <
• Connection #0 to host vault.bitwarden.com:443 left intact
  󰘧 curl -v -X POST https://vault.bitwarden.com/identity/accounts/prelogin
  -H "Content-Type: application/json"
  -H "Device-Type: 8"
  -d '{"email":"myemail@gmail.com"}'
  Note: Unnecessary use of -X or --request, POST is already inferred.
• Host vault.bitwarden.com:443 was resolved.
• IPv6: 2a04:4e42:4d::347, 2a04:4e42:4c::347
• IPv4: 199.232.197.91, 199.232.193.91
• Trying [2a04:4e42:4d::347]:443...
• Trying 199.232.197.91:443...
• ALPN: curl offers h2,http/1.1
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• SSL Trust Anchors:
• CAfile: /etc/ssl/certs/ca-certificates.crt
• TLSv1.3 (IN), TLS handshake, Server hello (2):
• TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
• TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
• TLSv1.3 (IN), TLS handshake, Certificate (11):
• TLSv1.3 (IN), TLS handshake, CERT verify (15):
• TLSv1.3 (IN), TLS handshake, Finished (20):
• TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
• TLSv1.3 (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519MLKEM768 / RSASSA-PSS
• ALPN: server accepted h2
• Server certificate:
• subject: CN=vault.bitwarden.com
• start date: Nov 2 11:12:54 2025 GMT
• expire date: Jan 31 11:12:53 2026 GMT
• issuer: C=US; O=Let's Encrypt; CN=R12
• Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
• Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
• Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
• subjectAltName: "vault.bitwarden.com" matches cert's "vault.bitwarden.com"
• SSL certificate verified via OpenSSL.
• Established connection to vault.bitwarden.com (2a04:4e42:4d::347 port 443) from 2804:79c8:219:e100:9ba4:fa04:264d:96fa port 49142
• using HTTP/2
• [HTTP/2] [1] OPENED stream for https://vault.bitwarden.com/identity/accounts/prelogin
• [HTTP/2] [1] [:method: POST]
• [HTTP/2] [1] [:scheme: https]
• [HTTP/2] [1] [:authority: vault.bitwarden.com]
• [HTTP/2] [1] [:path: /identity/accounts/prelogin]
• [HTTP/2] [1] [user-agent: curl/8.17.0]
• [HTTP/2] [1] [accept: /]
• [HTTP/2] [1] [content-type: application/json]
• [HTTP/2] [1] [device-type: 8]
• [HTTP/2] [1] [content-length: 32]

POST /identity/accounts/prelogin HTTP/2
Host: vault.bitwarden.com
User-Agent: curl/8.17.0
Accept: /
Content-Type: application/json
Device-Type: 8
Content-Length: 32

• upload completely sent off: 32 bytes
• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
  < HTTP/2 200
  < accept-ranges: bytes
  < access-control-allow-credentials: true
  < access-control-allow-origin: https://vault.bitwarden.com
  < x-xss-protection: 1; mode=block
  < content-type: application/json; charset=utf-8
  < x-content-type-options: nosniff
  < x-frame-options: SAMEORIGIN
  < date: Fri, 26 Dec 2025 19:28:02 GMT
  < vary: Origin
  < x-url-path: /identity/accounts/prelogin
  < strict-transport-security: max-age=31536000
  < content-length: 71
  <
• Connection #0 to host vault.bitwarden.com:443 left intact
  {"kdf":0,"kdfIterations":600000,"kdfMemory":null,"kdfParallelism":null}

BASICALLY: the correct place to check for prelogin is https://vault.bitwarden.com/identity/accounts/prelogin, not https://vault.bitwarden.com/api/accounts/prelogin

[mceck]

Thank you for your feedback, and I apologize for the late response. I was able to replicate the issue on the .com server, and I will look into it soon.

[mceck]

@Dexmachi The problem was not the URL (the official web app also uses the identity endpoint), but rather some additional headers required by the US server.

I’ve fixed this in the latest release 0.0.17. Could you please update npm install -g bitty-tui@latest, try again and confirm that it’s working now?

[Dexmachi]

@Dexmachi The problem was not the URL (the official web app also uses the identity endpoint), but rather some additional headers required by the US server.

I’ve fixed this in the latest release 0.0.17. Could you please update npm install -g bitty-tui@latest, try again and confirm that it’s working now?

gotcha, gonna try rn, ty

still doesn't work correctly, it still shows as "incorrect credentials"

[mceck]

I don't know how to replicate the problem.
Right now with the latest version I'm able to login on my test accounts on vault.bitwarden.eu , vault.bitwarden.com , and selfhosted vaultwarden.
Can you confirm you are on a version > 0.0.17? bitty --version
Maybe is some settings in your bw account unhandled by the app, can you give more info about your bw account security settings configuration (without exposing sensitive data)?
If you want to debug yourself the problem should be in the identity/connect/token or prelogin call
I can review and maybe accept a pr if you want to try