mirror of
https://github.com/open-webui/open-webui.git
synced 2026-05-06 10:58:17 -05:00
[GH-ISSUE #20942] issue: Previously working API keys now generating new "Internal server error" messages, JWT works ok. #34866
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @huornlmj on GitHub (Jan 26, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/20942
Check Existing Issues
Installation Method
Docker
Open WebUI Version
0.7.2
Ollama Version (if applicable)
N/A
Operating System
Ubuntu
Browser (if applicable)
N/A
Confirmation
README.md.Expected Behavior
Use API key or JWT when using the API.
Actual Behavior
Previously, when using the API, the API key worked in the
Authorization: Bearerheader. Now, the key throws a "Internal server error" response with the following truncated error in the docker container.Steps to Reproduce
Use the official documented method to converse with the API, using my API key (not JWT):
However, if I swap out the API key for my API JWT it works.
Logs & Screenshots
Additional Information
No response
@owui-terminator[bot] commented on GitHub (Jan 26, 2026):
🔍 Similar Issues Found
I found some existing issues that might be related to this one. Please check if any of these are duplicates or contain helpful solutions:
#20901 issue: Upgrade to 0.7.2 breaks API access
by huornlmj • Jan 23, 2026 •
bug#20842 issue: Critical Security Issue - JWT Token Authentication Bypass for API Endpoints
by HarukenM123 • Jan 21, 2026 •
bug#20064 issue: Create new API key (CRITICAL)
by richrich89 • Dec 20, 2025 •
bug#19853 issue: NOT ABLE TO CREATE A NEW API KEY:
by Code-With-Samuel • Dec 10, 2025 •
bug#19420 issue: Unable to create new api-keys - 403 forbidden
by DominikStarke • Nov 24, 2025 •
bugShow 4 more related issues
#19496 issue: 500 internal server error appears in v0.6.40
by cloudtuotuo • Nov 26, 2025 •
bug#19797 issue: Failure to start due to missing user.api_key
by aarononeal • Dec 07, 2025 •
bug#19755 issue: Error: 404, message='Not Found', url='http://ollama:11434/api/embed'
by stevewillett • Dec 04, 2025 •
bug#19915 issue: JWT auth causes 500 with stack trace
by pvutov • Dec 12, 2025 •
bug💡 Tips:
This comment was generated automatically by a bot. Please react with a 👍 if this comment was helpful, or a 👎 if it was not.
@Classic298 commented on GitHub (Jan 26, 2026):
per any chance did you upgrade from 0.6.36 or prior to 0.7.2?
Cannot reproduce on my end here.
@huornlmj commented on GitHub (Jan 26, 2026):
I don't know what version I upgraded from but I did upgrade. Does this make it a non-issue though? It's still broken here. Most users will be upgrading.
@Classic298 commented on GitHub (Jan 26, 2026):
@huornlmj
Yes this makes this a non issue and instead user error. Read the changelog, there was a major change on the .37 version where api key permissions were changed and you need to reconfigure it
@huornlmj commented on GitHub (Jan 26, 2026):
Could you share info? The documentation as I mentioned hasn't reflected this and still says to use an API key.
@Classic298 commented on GitHub (Jan 26, 2026):
https://docs.openwebui.com/getting-started/env-configuration#enable_api_keys
https://docs.openwebui.com/getting-started/advanced-topics/monitoring#authentication-setup-for-api-key-
https://docs.openwebui.com/getting-started/advanced-topics/monitoring#option-a-grant-permission-via-default-permissions
@huornlmj commented on GitHub (Jan 26, 2026):
Many thanks. That was it - new permissions. I searched all the change logs for "API" and couldn't find anything about it.
@huornlmj commented on GitHub (Jan 26, 2026):
Odd that it's throwing a server 500 error though, that sounds server-side, not permissions or authentication / authorization related.
@Classic298 commented on GitHub (Jan 26, 2026):
You need to enable user side permissions also.