[GH-ISSUE #17907] issue: API Key rejected for /api/v1/files/ upload despite correct config in v0.6.32 #33962

New Issue

GiteaMirror · 2026-04-25T07:50:47-05:00

GiteaMirror commented

2026-04-25 07:50:47 -05:00

Originally created by @sanctimon on GitHub (Sep 29, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/17907

Check Existing Issues

I have searched for any existing and/or related issues.
I have searched for any existing and/or related discussions.
I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

v0.6.32

Ollama Version (if applicable)

No response

Operating System

Ubuntu 24.04

Browser (if applicable)

No response

Confirmation

I have read and followed all instructions in README.md.
I am using the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided every relevant configuration, setting, and environment variable used in my setup.
I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
Start with the initial platform/version/OS and dependencies used,
Specify exact install/launch/configure commands,
List URLs visited, user input (incl. example values/emails/passwords if needed),
Describe all options and toggles enabled or changed,
Include any files or environmental changes,
Identify the expected and actual result at each stage,
Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

When sending a POST request to /api/v1/files/ with a valid API key in the Authorization: Bearer header, the server should accept the request and return a JSON response containing the uploaded file's metadata (e.g., file_id), as documented in the API Endpoints guide.

Actual Behavior

The server responds with:
{"detail":"Your session has expired or the token is invalid. Please sign in again."}
This occurs even when:

The API key is freshly regenerated from the account settings

The correct headers are used (Authorization: Bearer, Accept: application/json)

The environment variables ENABLE_API_KEY_ENDPOINT_RESTRICTIONS=false and API_KEY_ALLOWED_PATHS=/api/v1/files/,/api/chat/completions,/api/models are set in the Docker Compose file

Steps to Reproduce

Deploy Open WebUI v0.6.32 using Docker Compose with the following environment variables:
environment:

ENABLE_API_KEY_ENDPOINT_RESTRICTIONS=false
API_KEY_ALLOWED_PATHS=/api/v1/files/,/api/chat/completions,/api/models

Regenerate a new API key from the account settings.
Run the following curl command:

curl -X POST -H "Authorization: Bearer sk-XXXX" \
-H "Accept: application/json" \
-F "file=@/mnt/4tb_data/protasis_ai/n8n-local-files/SEFERIS_Apokalypsi_Ioannou.pdf" \
http://127.0.0.1:3000/api/v1/files/

Observe the response:
{"detail":"Your session has expired or the token is invalid. Please sign in again."}

Logs & Screenshots

From container logs:

2025-09-29 23:11:43.402 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 172.18.0.1:46892 - "POST /api/v1/files/ HTTP/1.1" 401
2025-09-29 23:12:12.485 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 172.18.0.1:52558 - "POST /api/v1/files/ HTTP/1.1" 401

Additional Information

Open WebUI version: v0.6.32

Deployment method: Docker Compose

API key tested multiple times, freshly regenerated

JWT token also tested, returns 401 Unauthorized

Attempted /api/signin for session-based login, but endpoint returns Method Not Allowed

The issue persists despite the merged fix in PR #8131.

Originally created by @sanctimon on GitHub (Sep 29, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/17907 ### Check Existing Issues - [x] I have searched for any existing and/or related issues. - [x] I have searched for any existing and/or related discussions. - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version v0.6.32 ### Ollama Version (if applicable) _No response_ ### Operating System Ubuntu 24.04 ### Browser (if applicable) _No response_ ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior When sending a POST request to /api/v1/files/ with a valid API key in the Authorization: Bearer header, the server should accept the request and return a JSON response containing the uploaded file's metadata (e.g., file_id), as documented in the [API Endpoints guide](https://docs.openwebui.com/getting-started/api-endpoints/). ### Actual Behavior The server responds with: `{"detail":"Your session has expired or the token is invalid. Please sign in again."} ` This occurs even when: The API key is freshly regenerated from the account settings The correct headers are used (Authorization: Bearer, Accept: application/json) The environment variables ENABLE_API_KEY_ENDPOINT_RESTRICTIONS=false and API_KEY_ALLOWED_PATHS=/api/v1/files/,/api/chat/completions,/api/models are set in the Docker Compose file ### Steps to Reproduce 1. Deploy Open WebUI v0.6.32 using Docker Compose with the following environment variables: environment: - ENABLE_API_KEY_ENDPOINT_RESTRICTIONS=false - API_KEY_ALLOWED_PATHS=/api/v1/files/,/api/chat/completions,/api/models 2. Regenerate a new API key from the account settings. 3. Run the following curl command: ``` curl -X POST -H "Authorization: Bearer sk-XXXX" \ -H "Accept: application/json" \ -F "file=@/mnt/4tb_data/protasis_ai/n8n-local-files/SEFERIS_Apokalypsi_Ioannou.pdf" \ http://127.0.0.1:3000/api/v1/files/ ``` 4. Observe the response: `{"detail":"Your session has expired or the token is invalid. Please sign in again."} ` ### Logs & Screenshots From container logs: ``` 2025-09-29 23:11:43.402 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 172.18.0.1:46892 - "POST /api/v1/files/ HTTP/1.1" 401 2025-09-29 23:12:12.485 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 172.18.0.1:52558 - "POST /api/v1/files/ HTTP/1.1" 401 ``` ### Additional Information Open WebUI version: v0.6.32 Deployment method: Docker Compose API key tested multiple times, freshly regenerated JWT token also tested, returns 401 Unauthorized Attempted /api/signin for session-based login, but endpoint returns Method Not Allowed The issue persists despite the merged fix in PR #8131.

GiteaMirror added the bug label 2026-04-25 07:50:47 -05:00

GiteaMirror closed this issue

2026-04-25 07:50:49 -05:00

GiteaMirror commented

2026-04-25 07:50:49 -05:00

@tjbck commented on GitHub (Sep 30, 2025):

Unable to reproduce.

@tjbck commented on GitHub (Sep 30, 2025): Unable to reproduce.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#33962