Ota password not working?

I’m trying to develop an ESPHome device with a web server with ota upload.
I would like the web server to have no credentials but the ota upload to require a password
I tried the following config and I can upload ota from the web server whether in ap mode (first boot) or in “normal” (after entering wifi credentials) web server mode.

I figure I’m missing something as this is pretty basic
Thanks

esphome:
  name: test
  friendly_name: Test

esp8266:
  board: d1_mini

# Enable logging
logger:

# Enable Home Assistant API
api:
  encryption:
    key: "6IHTkOg5WgeYXDFwRynoqZ16yK+KxDssxAdG5wtyg+A="
  reboot_timeout: 0s # prevent reboots every 15 minutes when no Home Assistant connected

ota:
  password: "bf53c565a3854902a16572a3e119bbb3"

wifi:
  # Enable fallback hotspot (captive portal) in case wifi connection fails
  ap:
    ssid: "Test Fallback Hotspot"
    password: "9nzfrLLCRrWX"

captive_portal:

web_server:
  port: 80
  ota: True
  local: false # change to true if no internet

button:
  - platform: factory_reset
    name: Restart with Factory Default Settings

Pretty sure you cannot have it both ways. The documentation even recommends setting auth for the web server if you enable the OTA option.

ota (Optional, boolean): Turn on or off the OTA feature inside webserver. Strongly not suggested without enabled authentication settings. Defaults to true. Cannot be used with the esp-idf framework.

Thanks @FriedCheese for the quick response

That’s a shame as I wanted general viewing (as there’s going to be no user input) but with restricted upload