After upgrading from 0.4.8 to 0.5.1 api key authentication is not working

[df-cgdm]

Bug Report

Installation Method

Docker

Environment

• Open WebUI 0.5.1

Confirmation:

• I have read and followed all the instructions provided in the README.md.
• I am on the latest version of both Open WebUI and Ollama.
• I have included the browser console logs.
• I have included the Docker container logs.
• I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below.

Expected Behavior:

When I'm calling the API (ollama or openai endpoints) with the API key it should accept it

Actual Behavior:

I get a 403 with the following detail

{
  "detail": "Use of API key is not enabled in the environment."
}

Description

Bug Summary:
Even if ENABLE_API_KEY is True the api_key is not accepted any more.

Reproduction Details

Steps to Reproduce:
1/ Install the version 0.4.8 enable the API Key Auth.
2/ Any call to the api using the API key is working
3/ Upgrade to version 0.5.1
4/ Verify in the Admin UI that Enable API Key Auth is still enabled
5/ Any call to the api using the API key is receiving a 403 "Use of API key is not enabled in the environment."

Logs and Screenshots

Docker Container Logs:
NFO: 10.62.42.19:0 - "GET /openai/models HTTP/1.1" 403 Forbidden

Screenshots/Screen Recordings (if applicable):

Additional Information

For what I've seen this is related to this commit
a2366a2

[rchaklashiya]

I'm having a similar issue. In the updated 5.1 version I cannot upload pdf's by API via python (I am getting a 405 Error, {"detail":"Method Not Allowed"}). Meanwhile doing queries via API via python still works for me. So it seems like it's related to the commit you mentioned, as the pdf upload is govered by ''/api/v1/files' which does not appear to be in the allowed list for 5.1, meanwhile queries are under '/v1/chat/completions' which is allowed in 5.1.
I still need to try an older version of Open Web UI to doublecheck (not that experienced with downgrading so am struggling a bit on that end)

[ghmer]

Me too. Cannot access the ollama backend via open-webui at all. Please fix!

[yanismiraoui]

Me too, having a lot issues since update.

[rchaklashiya]

I'm having a similar issue. In the updated 5.1 version I cannot upload pdf's by API via python (I am getting a 405 Error, {"detail":"Method Not Allowed"}). Meanwhile doing queries via API via python still works for me. So it seems like it's related to the commit you mentioned, as the pdf upload is govered by ''/api/v1/files' which does not appear to be in the allowed list for 5.1, meanwhile queries are under '/v1/chat/completions' which is allowed in 5.1. I still need to try an older version of Open Web UI to doublecheck (not that experienced with downgrading so am struggling a bit on that end)

Update on this: I downgraded to 0.4.8 to doublecheck what was going on, and there the issue is different (a 422 error, {"detail":[{"type":"missing","loc":["body","file"],"msg":"Field required","input":null}]},

However, I checked my code and noticed the mistake, I was using 'Content-Type' in my headers dictionary instead of 'Accept'.

Once I fixed that, the pdf uploaded properly (albeit it did so while giving a "'NoneType' object is not iterable" error, so there is still something wrong, which I am in the process of trying to figure out now).

I'm not sure if I want to try this on 0.5.1 just yet, as the error is very different there, and based on the commit given by OP I think the issue is probably more fundamental in that version at the present moment.

[AzizDXT]

I am unable to upload a file, unfortunately, nor access knowledge at all!

[rchaklashiya]

I'm having a similar issue. In the updated 5.1 version I cannot upload pdf's by API via python (I am getting a 405 Error, {"detail":"Method Not Allowed"}). Meanwhile doing queries via API via python still works for me. So it seems like it's related to the commit you mentioned, as the pdf upload is govered by ''/api/v1/files' which does not appear to be in the allowed list for 5.1, meanwhile queries are under '/v1/chat/completions' which is allowed in 5.1. I still need to try an older version of Open Web UI to doublecheck (not that experienced with downgrading so am struggling a bit on that end)

Update on this: I downgraded to 0.4.8 to doublecheck what was going on, and there the issue is different (a 422 error, {"detail":[{"type":"missing","loc":["body","file"],"msg":"Field required","input":null}]},

However, I checked my code and noticed the mistake, I was using 'Content-Type' in my headers dictionary instead of 'Accept'.

Once I fixed that, the pdf uploaded properly (albeit it did so while giving a "'NoneType' object is not iterable" error, so there is still something wrong, which I am in the process of trying to figure out now).

I'm not sure if I want to try this on 0.5.1 just yet, as the error is very different there, and based on the commit given by OP I think the issue is probably more fundamental in that version at the present moment.

Just now I'm realizing that downgrading also purged my models...and also made me unable to upload any more models :/
I'm going to upgrade to 0.5.1 again and see if that fixes that.

[rchaklashiya]

I'm having a similar issue. In the updated 5.1 version I cannot upload pdf's by API via python (I am getting a 405 Error, {"detail":"Method Not Allowed"}). Meanwhile doing queries via API via python still works for me. So it seems like it's related to the commit you mentioned, as the pdf upload is govered by ''/api/v1/files' which does not appear to be in the allowed list for 5.1, meanwhile queries are under '/v1/chat/completions' which is allowed in 5.1. I still need to try an older version of Open Web UI to doublecheck (not that experienced with downgrading so am struggling a bit on that end)

Update on this: I downgraded to 0.4.8 to doublecheck what was going on, and there the issue is different (a 422 error, {"detail":[{"type":"missing","loc":["body","file"],"msg":"Field required","input":null}]},
However, I checked my code and noticed the mistake, I was using 'Content-Type' in my headers dictionary instead of 'Accept'.
Once I fixed that, the pdf uploaded properly (albeit it did so while giving a "'NoneType' object is not iterable" error, so there is still something wrong, which I am in the process of trying to figure out now).
I'm not sure if I want to try this on 0.5.1 just yet, as the error is very different there, and based on the commit given by OP I think the issue is probably more fundamental in that version at the present moment.

Just now I'm realizing that downgrading also purged my models...and also made me unable to upload any more models :/ I'm going to upgrade to 0.5.1 again and see if that fixes that.

I upgraded to 0.5.1 and that gave me back my models.

I tested out uploading a PDF via API in python with my fix that worked in 0.4.8 and I'm still getting a Error: 405, {"detail":"Method Not Allowed"}, which I think means that the commit issue is the culprit here.

**Update: Actually, reading through the commit, I realized that it doesn't involve a 405 error nor does it involve the error message I encountered--which leads me to think there is another issue somewhere else in Open Web UI's code (wherever a 405 error is mentioned). I'm looking for it now.

[tjbck]

Please read the changelogs before updating. JWT should be used in this case instead of API keys.

[ProjectMoon]

There isn't anything about JWT in the change log. Was it a missed patch note?

[tjbck]

Related: #7322
cc @DmitriyAlergant-T1A

[ProjectMoon]

I mean, I saw that note, yes. But it doesn't explain that JWTs are now in use or how to get them. I'll look at the PR though.

[tjbck]

@ProjectMoon JWT should work as a drop in replacement!

[ProjectMoon]

I mean, I saw that note, yes. But it doesn't explain that JWTs are now in use or how to get them. I'll look at the PR though.

@ProjectMoon JWT should work as a drop in replacement!

That works perfectly, thanks!

[DmitriyAlergant]

Keep in mind that JWTs reset on any app restart. Also they may have limited expiration date (if enabled in admin general settings).

Ideally you are supposed to get fresh JWTs ad-hoc via a /signin call.

[ProjectMoon]

Hmmm. Part of the problem, I think, is that the changes have locked down the entirety of the proxied ollama API. Wouldn't it make sense to allow API key access to similar completion/model list endpoints on the proxied APIs?