In KH, choosing the correct mount policy is part of choosing the authenticator. A perfect password file cannot protect a request that matches a different, more permissive block. Establish the selected exact or wildcard rule before diagnosing user accounts.

Add a private user file

This complete mount excerpt goes inside the existing <icecast> root. Replace the absolute file location and supply an active test source separately:

xml · Code example
<mount>
  <mount-name>/members.ogg</mount-name>
  <authentication type="htpasswd">
    <option name="filename" value="/ABSOLUTE/PRIVATE/PATH/listeners"/>
    <option name="allow_duplicate_users" value="0"/>
  </authentication>
</mount>

Keep the user file outside webroot and allow only the required service access. Use KH’s supported administration workflow for maintaining accounts; an external password utility’s default hash is not automatically compatible. In the documented web workflow, the source must be active before its mount is shown for account management.

allow_duplicate_users=0 is the classic same-account concurrency switch, not an arbitrary per-account session allowance. Test the second connection if that policy matters. Use separate source and administrator identities; successful listener login should not imply either privilege.

Check every public path to the media

Try the direct mount, an alias if configured, and any backup that can be requested independently. Test no credentials, an incorrect secret and a valid disposable account. Check intro and fallback transitions without assuming the original request authenticates every later path in the way you intend.

HTTP Basic requires protected transport when crossing a network. Avoid embedding credentials in playlist URLs or copied links. Players differ in how they obtain and retain credentials, so verify the actual application, not only a command-line probe.

Diagnose admission in order

First prove the selected mount exists and the expected pattern wins. Then check file access and account maintenance, followed by the player request and server error at the same timestamp. The old documentation’s claim that only htpasswd exists is contradicted by its later URL section and the pinned implementation. For callback decisions, use KH URL authentication, not regular Icecast 2.5 role syntax.