mirror of
https://github.com/open-webui/open-webui.git
synced 2026-05-06 10:58:17 -05:00
[GH-ISSUE #16655] feat: ENABLE_API_KEY admin only #33525
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/open-webui#33525
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ncecere on GitHub (Aug 16, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/16655
Check Existing Issues
Problem Description
I have started work on a terraform provider for open web ui. I'm not sure if this is possible but having the ability for lock down the api to Admin only API keys would be great. Or the abilty to target endpoints to roles. like..
API_KEY_ALLOWED_ENDPOINTS_ADMIN
API_KEY_ALLOWED_ENDPOINTS_USER
If this exists or is already possible I haven't seen it documented
Desired Solution you'd like
Ability to lock the API down to Admin Keys only
API_KEY_ALLOWED_ENDPOINTS_ADMIN
API_KEY_ALLOWED_ENDPOINTS_USER
Alternatives Considered
Ability to define API endpoints by user Role
API_KEY_ALLOWED_ENDPOINTS_ADMIN
API_KEY_ALLOWED_ENDPOINTS_USER
Additional Context
No response
@Ark-Levy commented on GitHub (Sep 11, 2025):
@tjbck can you tell me more about why you chose to close this issue ?
I would like to create technical api keys in admin the pannel. My purpose is to purge data automaticly via api.
I don't want my users to use api keys.
Do you think it is a good idea ?
@Classic298 commented on GitHub (Sep 11, 2025):
users can always use the API anyways (and only the user endpoints / endpoints they have access to)
for purging data / pruning data (you mean #16520 ? or what do you mean?)
@Ark-Levy commented on GitHub (Sep 12, 2025):
@Classic298 If ApiKey is disabled in admin pannel, no one can use the key.
I want to allow admin only keys. I'll check yout issue #16520
@Classic298 commented on GitHub (Sep 14, 2025):
I understand. I think a setting via env var and perhaps also a toggle in the admin panel can easily be implemented, do you want to create a PR for this?
@brtptrs commented on GitHub (Oct 27, 2025):
It would be great if ENABLE_API_KEY could be set via group permissions
@brtptrs commented on GitHub (Oct 29, 2025):
I found this pr
https://github.com/open-webui/open-webui/pull/18336#issue-3514781852
@R-Rausch commented on GitHub (Oct 29, 2025):
It would be great if ENABLE_API_KEY could be set via group permissions, which would make things easier for everyone.