enh: Configurable Option to Disable Private API Key Creation & Use

[antpyykk-kone]

Is your feature request related to a problem? Please describe.

I'm requesting an enhancement to control the creation and use of API keys in our deployment environment. Specifically, we want the ability to disable the creation and use of private API keys in certain environments, and we need this to be configurable. This is to prevent any potential misuse of private keys.

Describe the solution you'd like

• Introduce new PersistentConfig & environment variable option for toggling the private API key generation & use. Value is by default set to true - i.e. enabled & the application performs like usual.
• If use of private API keys is disabled, then:
  1. the section for private API keys (Settings > Account > API Keys) is disabled with a tooltip / info text to explain that private API keys are not enabled in the environment / workspace.
  2. API authentication using a private keys will results in 403 Forbidden
  3. Creation of new API keys is disabled

Describe alternatives you've considered

A few alternatives exist for us to achieve similar results:

1. Pipeline Filters : Using pipeline filters to prevent the authentication process with private API keys. (Not possible with the current API structure since it does not expose the underlying API request)
2. Future Solutions : Awaiting more comprehensive solutions, such as enh: open webui built-in usage tracking/limit #6692.
3. Additional Monitoring & Surveillance: If disabling is not desirable/possible, we can also try to utilize monitoring to find out potential misuses and revoke the API keys

Additional context

I would like to hear opinions on if this behaviour is accepted.
We can implement a draft PR to enable this enhancement.

[antpyykk-kone]

Since there were no answers, I've gone ahead and made changes in my own fork. The changes are available here:
dev...antpyykk-kone:feature/config-private-api-key-use

Changelog

• Add new configuration option for ENABLE_API_KEY_AUTH which by default is set to true to ensure backwards compatibility
• If the configuration option is set to false, authentication using API key is disabled and generating new API keys is prevented (resulting in 403 - Forbidden)

Settings modal for managing the keys is also hidden

---

I would like to hear still if certain things should be done differently or if there are differing opinions before raising the PR.

[cdvankammen]

do you have this code still? I would like to be able to do this but lookslike its not there anymore?

[lilleswing]

I think this would be a very good feature!

[Classic298]

As written in the docs:

API keys are disabled by default — ENABLE_API_KEYS defaults to False. So unless you explicitly enabled it, API key auth is already off in your deployment.

If you do want to use the OpenAI-compatible API programmatically (e.g. via curl or a client library), you'll need API keys enabled. For that, two things are required:

1. Set ENABLE_API_KEYS to True (global toggle)
2. Grant the "API Keys" permission to users via Default Permissions or User Groups (admins are not exempt from this either)

Both conditions must be met for API key creation and authentication to work. The full details are in the environment variable configuration docs under "API Key Endpoint Restrictions": https://docs.openwebui.com/reference/env-configuration#api-key-endpoint-restrictions

[cdvankammen]

Correct, and I am wondering if there is a way to disable that specific feature and by pass the need for API keys to use the back end

[Classic298]

Open WebUI's API always requires authentication — either a JWT session token (from logging in via the UI) or an API key. There is no built-in toggle to make the API endpoints publicly accessible without any authentication while keeping the UI authenticated.

The only way to fully disable authentication is setting WEBUI_AUTH to False, but that disables auth for the entire application (UI included), and only works on fresh installations with no existing users.

If your goal is to use the API locally without having to deal with API keys specifically, you can authenticate using your JWT session token instead — you get one automatically when you log in. But some form of authentication is always required by design.

What you're describing (an unauthenticated backend API) would be a separate feature request, as it doesn't currently exist.

[cdvankammen]

Sounds good. Worry about authentication in the end is always good however for initial set up (especially from new users) add a level of complexity when we are trying to figure out how to use it with other systems that sometimes makes it difficult to know what's going on. (Mostly what I'm dealing with )

[Classic298]

Totally understandable — the initial setup can feel like a lot of moving parts. If you haven't already, the docs have a step-by-step guide for getting API key auth set up: https://docs.openwebui.com/reference/monitoring#authentication-setup-for-api-key-

Once you have that working, you can use Open WebUI as a drop-in replacement for the OpenAI API with any client library. Hope that helps!