2 files changed, 7 insertions, 4 deletions
diff --git a/src/buildtool/serve_api/serve_service/serve_server_implementation.cpp b/src/buildtool/serve_api/serve_service/serve_server_implementation.cpp
index 1d81ebb0..906f331c 100644
--- a/src/buildtool/serve_api/serve_service/serve_server_implementation.cpp
+++ b/src/buildtool/serve_api/serve_service/serve_server_implementation.cpp
@@ -18,6 +18,7 @@
 
 #include <iostream>
 #include <memory>
+#include <variant>
 
 #ifdef __unix__
 #include <sys/types.h>
@@ -132,13 +133,15 @@ auto ServeServerImpl::Run(RemoteServeConfig const& serve_config,
             .RegisterService(&op);
     }
 
+    // check authentication credentials; currently only TLS/SSL is supported
     std::shared_ptr<grpc::ServerCredentials> creds;
-    if (apis.auth != nullptr) {
+    if (const auto* tls_auth = std::get_if<Auth::TLS>(&apis.auth.method);
+        tls_auth != nullptr) {
         auto tls_opts = grpc::SslServerCredentialsOptions{};
 
-        tls_opts.pem_root_certs = apis.auth->CACert();
+        tls_opts.pem_root_certs = tls_auth->ca_cert;
         grpc::SslServerCredentialsOptions::PemKeyCertPair keycert = {
-            apis.auth->ServerKey(), apis.auth->ServerCert()};
+            tls_auth->server_key, tls_auth->server_cert};
 
         tls_opts.pem_key_cert_pairs.emplace_back(keycert);
 
diff --git a/src/buildtool/serve_api/serve_service/target.cpp b/src/buildtool/serve_api/serve_service/target.cpp
index fc09ee8c..44632590 100644
--- a/src/buildtool/serve_api/serve_service/target.cpp
+++ b/src/buildtool/serve_api/serve_service/target.cpp
@@ -499,7 +499,7 @@ auto TargetService::ServeTarget(
 
         // Use a new ApiBundle that knows about local repository config for
         // traversing.
-        ApiBundle const local_apis{&repository_config, apis_.auth, address};
+        ApiBundle const local_apis{&repository_config, &apis_.auth, address};
         GraphTraverser const traverser{
             std::move(traverser_args),
             &repository_config,