diff --git a/homelab-ai-bot/savetv_extra_routes.py b/homelab-ai-bot/savetv_extra_routes.py
index 8397b4a1..854beace 100644
--- a/homelab-ai-bot/savetv_extra_routes.py
+++ b/homelab-ai-bot/savetv_extra_routes.py
@@ -21,6 +21,8 @@ JELLYFIN_PASS = _os.environ.get("JELLYFIN_PASS", "astral66")
 # Direkter Download ohne Cloudflare (Hetzner :9443 → nginx → CT 116)
 SAVETV_DIRECT_BASE = _os.environ.get("SAVETV_DIRECT_BASE", "http://138.201.84.95:9443")
 SAVETV_TUNNEL_BASE = _os.environ.get("SAVETV_TUNNEL_BASE", "https://savetv.orbitalo.net")
+SAVETV_DIRECT_USER = _os.environ.get("SAVETV_DIRECT_USER", "mike")
+SAVETV_DIRECT_PASS = _os.environ.get("SAVETV_DIRECT_PASS", "astral66")
 
 
 def _normalize_film_title(s: str) -> str:
@@ -181,7 +183,9 @@ def register_extra_routes(app, progress_lock=None, load_progress_raw=None, save_
             clean = name.rsplit(".", 1)[0]
             esc = _html.escape(name, quote=True)
             date_str = _dt.fromtimestamp(mtime).strftime("%d.%m.%Y")
-            href_direct = SAVETV_DIRECT_BASE.rstrip("/") + "/files/" + _urlquote(name)
+            _b = SAVETV_DIRECT_BASE.split("://", 1)
+            _auth = _urlquote(SAVETV_DIRECT_USER) + ":" + _urlquote(SAVETV_DIRECT_PASS) + "@"
+            href_direct = _b[0] + "://" + _auth + _b[1].lstrip("/").rstrip("/") + "/files/" + _urlquote(name)
             href_tunnel = SAVETV_TUNNEL_BASE.rstrip("/") + "/files/" + _urlquote(name)
             rows += (
                 '<tr data-name="' + _html.escape(clean.lower(), quote=True) + '" '
@@ -222,11 +226,10 @@ def register_extra_routes(app, progress_lock=None, load_progress_raw=None, save_
             '<h1>&#128193; Gespeicherte Filme</h1>'
             '<div class="sub">' + str(len(files)) + ' Dateien &middot; ' + str(total_gb) + ' GB</div>'
             '<div class="sub" style="margin-top:16px;padding:12px 16px;background:#1a1a24;border:1px solid #2a2a3a;border-radius:8px;font-size:14px;max-width:1100px;line-height:1.55">'
-            'Direkt vom Hetzner (ohne Cloudflare): Download-Links zeigen auf '
-            '<code style="color:#e0e0e8">' + _html.escape(SAVETV_DIRECT_BASE, quote=True) + '</code> &mdash; '
-            'Basic-Auth mit Benutzer <code>mike</code>, Passwort wie in <code>homelab.conf</code>. '
-            'Fallback: Link <span style="color:#888">CF</span> pro Zeile (Cloudflare-Tunnel, '
-            '<code style="color:#e0e0e8">' + _html.escape(SAVETV_TUNNEL_BASE, quote=True) + '</code>).'
+            'Direkt vom Hetzner (ohne Cloudflare). '
+            'Credentials sind im Link eingebettet &ndash; Browser-Auth-Dialog sollte nicht erscheinen. '
+            'Fallback-Link <span style="color:#888">CF</span> pro Zeile nutzt den Cloudflare-Tunnel '
+            '(<code style="color:#e0e0e8">' + _html.escape(SAVETV_TUNNEL_BASE, quote=True) + '</code>).'
             '</div>'
             '<div class="sortbar"><span>Sortieren:</span>'
             '<button class="sbtn active" data-sort="date" data-dir="desc" onclick="sortBy(this)">Datum <span class="arrow">&#9660;</span></button>'