[PR #7041] [MERGED] feat: Ability to configure the use of private API keys in an environment #8802

New Issue

GiteaMirror · 2025-11-11T18:06:22-06:00

GiteaMirror commented

2025-11-11 18:06:22 -06:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/7041
Author: @antpyykk-kone
Created: 11/19/2024
Status: ✅ Merged
Merged: 11/19/2024
Merged by: @tjbck

Base: dev ← Head: feature/configure-private-api-key-usage

📝 Commits (2)

979e6e5 feat: support for configuring private api key use
7a585fb enh: option to disable api auth

📊 Changes

9 files changed (+122 additions, -88 deletions)

View changed files

📝 backend/open_webui/apps/webui/main.py (+3 -0)
📝 backend/open_webui/apps/webui/routers/auths.py (+14 -2)
📝 backend/open_webui/config.py (+7 -0)
📝 backend/open_webui/constants.py (+2 -0)
📝 backend/open_webui/main.py (+2 -0)
📝 backend/open_webui/utils/utils.py (+4 -3)
📝 src/lib/components/admin/Settings/General.svelte (+6 -0)
📝 src/lib/components/chat/Settings/Account.svelte (+83 -83)
📝 src/lib/stores/index.ts (+1 -0)

📄 Description

Pull Request Checklist

Note to first-time contributors: Please open a discussion post in Discussions and describe your changes before submitting a pull request.

Before submitting, make sure you've checked the following:

Target branch: Please verify that the pull request targets the dev branch.
Description: Provide a concise description of the changes made in this pull request.
Changelog: Ensure a changelog entry following the format of Keep a Changelog is added at the bottom of the PR description.
Documentation: Have you updated relevant documentation Open WebUI Docs, or other documentation sources?
Dependencies: Are there any new dependencies? Have you updated the dependency versions in the documentation?
Testing: Have you written and run sufficient tests for validating the changes?
Code review: Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?
Prefix: To cleary categorize this pull request, prefix the pull request title, using one of the following:
- BREAKING CHANGE: Significant changes that may affect compatibility
- build: Changes that affect the build system or external dependencies
- ci: Changes to our continuous integration processes or workflows
- chore: Refactor, cleanup, or other non-functional code changes
- docs: Documentation update or addition
- feat: Introduces a new feature or enhancement to the codebase
- fix: Bug fix or error correction
- i18n: Internationalization or localization changes
- perf: Performance improvement
- refactor: Code restructuring for better maintainability, readability, or scalability
- style: Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc.)
- test: Adding missing tests or correcting existing tests
- WIP: Work in progress, a temporary label for incomplete or ongoing work

Changelog Entry

Description

Introduce a configuration option to disable private API key use and generation in an environment. When disabled, only JWT can be used to authenticate, helping to prevent potential misuse. By default private API keys are still enabled.

Added

A new configuration option ENABLE_API_KEY_AUTH to control private API key use in an environment.

Changed

Prevent authentication using API key, if ENABLE_API_KEY_AUTH config is disabled
Prevent creation of API keys, if ENABLE_API_KEY_AUTH config is disabled
Hide UI section for managing API keys (under Settings > Account), if ENABLE_API_KEY_AUTH config is disabled
Import of WEBUI_AUTH in auths.py was moved to be imported from open_webui.env where it originates from

Additional Information

This is a reopened version of #6950. This PR resolves merge conflicts against dev & fixes an issue with configuration option use. Updating locales has been left out.
Discussion for this functionality was started in #6756
A slight overlap with discussed functionality in #6692

Screenshots or Videos

Sample API Requests

When ENABLE_API_KEY_AUTH=False.

Making calls to endpoints using API key

curl 'http://localhost:8080/api/v1/models/' \
  -H 'Authorization: Bearer <API-KEY>' \
  -w "\nHTTP Status: %{http_code}\n"

{ "detail":"Use of API key is not enabled in the environment." }
HTTP Status: 403

Trying to create a new API key

curl -X 'POST' \
  'http://localhost:8080/api/v1/auths/api_key' \
  -H 'Authorization: Bearer <JWT>' \
  -H 'accept: application/json'
  -w "\nHTTP Status: %{http_code}\n"

{ "detail": "API key creation is not allowed in the environment." }
HTTP Status: 403

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/7041 **Author:** [@antpyykk-kone](https://github.com/antpyykk-kone) **Created:** 11/19/2024 **Status:** ✅ Merged **Merged:** 11/19/2024 **Merged by:** [@tjbck](https://github.com/tjbck) **Base:** `dev` ← **Head:** `feature/configure-private-api-key-usage` --- ### 📝 Commits (2) - [`979e6e5`](https://github.com/open-webui/open-webui/commit/979e6e5a79252d402d01a7d7aa380cdc8f78f5f2) feat: support for configuring private api key use - [`7a585fb`](https://github.com/open-webui/open-webui/commit/7a585fbaf34a8864309d85350c0b8fda97dae8c5) enh: option to disable api auth ### 📊 Changes **9 files changed** (+122 additions, -88 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/apps/webui/main.py` (+3 -0) 📝 `backend/open_webui/apps/webui/routers/auths.py` (+14 -2) 📝 `backend/open_webui/config.py` (+7 -0) 📝 `backend/open_webui/constants.py` (+2 -0) 📝 `backend/open_webui/main.py` (+2 -0) 📝 `backend/open_webui/utils/utils.py` (+4 -3) 📝 `src/lib/components/admin/Settings/General.svelte` (+6 -0) 📝 `src/lib/components/chat/Settings/Account.svelte` (+83 -83) 📝 `src/lib/stores/index.ts` (+1 -0) </details> ### 📄 Description # Pull Request Checklist ### Note to first-time contributors: Please open a discussion post in [Discussions](https://github.com/open-webui/open-webui/discussions) and describe your changes before submitting a pull request. **Before submitting, make sure you've checked the following:** - [x] **Target branch:** Please verify that the pull request targets the `dev` branch. - [x] **Description:** Provide a concise description of the changes made in this pull request. - [x] **Changelog:** Ensure a changelog entry following the format of [Keep a Changelog](https://keepachangelog.com/) is added at the bottom of the PR description. - [ ] **Documentation:** Have you updated relevant documentation [Open WebUI Docs](https://github.com/open-webui/docs), or other documentation sources? - [x] **Dependencies:** Are there any new dependencies? Have you updated the dependency versions in the documentation? - [ ] **Testing:** Have you written and run sufficient tests for validating the changes? - [x] **Code review:** Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards? - [x] **Prefix:** To cleary categorize this pull request, prefix the pull request title, using one of the following: - **BREAKING CHANGE**: Significant changes that may affect compatibility - **build**: Changes that affect the build system or external dependencies - **ci**: Changes to our continuous integration processes or workflows - **chore**: Refactor, cleanup, or other non-functional code changes - **docs**: Documentation update or addition - **feat**: Introduces a new feature or enhancement to the codebase - **fix**: Bug fix or error correction - **i18n**: Internationalization or localization changes - **perf**: Performance improvement - **refactor**: Code restructuring for better maintainability, readability, or scalability - **style**: Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc.) - **test**: Adding missing tests or correcting existing tests - **WIP**: Work in progress, a temporary label for incomplete or ongoing work # Changelog Entry ### Description - Introduce a configuration option to disable private API key use and generation in an environment. When disabled, only JWT can be used to authenticate, helping to prevent potential misuse. By default private API keys are still enabled. ### Added - A new configuration option `ENABLE_API_KEY_AUTH` to control private API key use in an environment. ### Changed - Prevent authentication using API key, if `ENABLE_API_KEY_AUTH` config is disabled - Prevent creation of API keys, if `ENABLE_API_KEY_AUTH` config is disabled - Hide UI section for managing API keys (under Settings > Account), if `ENABLE_API_KEY_AUTH` config is disabled - Import of `WEBUI_AUTH` in `auths.py` was moved to be imported from `open_webui.env` where it originates from --- ### Additional Information - This is a reopened version of #6950. This PR resolves merge conflicts against `dev` & fixes an issue with configuration option use. Updating locales has been left out. - Discussion for this functionality was started in #6756 - A slight overlap with discussed functionality in #6692 ### Screenshots or Videos ![Screenshot showcasing disabled API key usage](https://github.com/user-attachments/assets/010232b5-544b-4484-b4c0-fef1d93525a5) #### Sample API Requests When `ENABLE_API_KEY_AUTH=False`. Making calls to endpoints using API key ```sh curl 'http://localhost:8080/api/v1/models/' \ -H 'Authorization: Bearer <API-KEY>' \ -w "\nHTTP Status: %{http_code}\n" { "detail":"Use of API key is not enabled in the environment." } HTTP Status: 403 ``` Trying to create a new API key ```sh curl -X 'POST' \ 'http://localhost:8080/api/v1/auths/api_key' \ -H 'Authorization: Bearer <JWT>' \ -H 'accept: application/json' -w "\nHTTP Status: %{http_code}\n" { "detail": "API key creation is not allowed in the environment." } HTTP Status: 403 ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-11 18:06:22 -06:00

GiteaMirror closed this issue

2025-11-11 18:06:23 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#8802