{"record":{"id":"ec84da882dd8e54b","repo":"wandb/openui","slug":"login-required-to-use-openui","errorCode":null,"errorMessage":"Login required to use OpenUI","messagePattern":"Login required to use OpenUI","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"backend/openui/server.py","lineNumber":118,"sourceCode":"    allow_origins=[config.CORS_ORIGINS],\n    allow_credentials=True,\n    allow_methods=[\"*\"],\n    allow_headers=[\"*\"],\n)\n\n\n@router.post(\"/v1/chat/completions\", tags=[\"openui/chat\"])\n@router.post(\n    \"/chat/completions\",\n    tags=[\"openui/chat\"],\n)\nasync def chat_completions(\n    request: Request,\n    # chat_request: CompletionCreateParams,  # TODO: lots' fo weirdness here, just using raw json\n    # ctx: Any = Depends(weave_context),\n):\n    if request.session.get(\"user_id\") is None:\n        raise HTTPException(status_code=401, detail=\"Login required to use OpenUI\")\n    user_id = request.session[\"user_id\"]\n    yesterday = datetime.now() - timedelta(days=1)\n    tokens = Usage.tokens_since(user_id, yesterday.date())\n    if config.ENV == config.Env.PROD and tokens > config.MAX_TOKENS:\n        raise HTTPException(\n            status_code=429,\n            detail=\"You've exceeded our usage quota, come back tomorrow to generate more UI.\",\n        )\n    try:\n        data = await request.json()  # chat_request.model_dump(exclude_unset=True)\n        input_tokens = count_tokens(data[\"messages\"])\n        # TODO: we always assume 4096 max tokens (random fudge factor here)\n        data[\"max_tokens\"] = 4096 - input_tokens - 20\n        # TODO: refactor all these blocks into one once Ollama supports vision\n        # OpenAI Models\n        if data.get(\"model\").startswith(\"gpt\"):\n            if data[\"model\"] == \"gpt-4\" or data[\"model\"] == \"gpt-4-32k\":\n                raise HTTPException(status=400, data=\"Model not supported\")","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/wandb/openui/blob/42d7ab4ab6650433486dfb12eb3783c393a3e475/backend/openui/server.py#L100-L136","documentation":"chat_completions guards the OpenAI-compatible chat endpoint: if the request session has no user_id, it raises HTTP 401 'Login required to use OpenUI'. Sessions are cookie-based, so any client that hasn't logged in through the web UI gets rejected.","triggerScenarios":"Calling POST /v1/chat/completions (or similar) without a logged-in session cookie; session cookie expired or cleared; calling from a script/curl without first authenticating; session backend (e.g. signed-cookie secret change) invalidated sessions.","commonSituations":"Programmatic API clients pointing at the UI endpoint expecting token auth; server restart wiping in-memory sessions; SECRET_KEY rotated, invalidating all cookies; browser blocking third-party/first-party cookies.","solutions":["Log in via the OpenUI UI so a valid session cookie is set before calling the endpoint.","Send the session cookie with your request (cookies param in requests, credentials: 'include' in fetch).","If sessions were invalidated, re-login; if server-side, verify the session middleware secret is stable.","Confirm cookie settings (SameSite/Secure) aren't preventing the session cookie from being sent."],"exampleFix":"// before\nrequests.post('http://localhost:7878/v1/chat/completions', json=payload)\n// after\ns = requests.Session()\ns.post('http://localhost:7878/auth/login', data={'username': u})  # establish session\nr = s.post('http://localhost:7878/v1/chat/completions', json=payload)","handlingStrategy":"validation","validationCode":"import requests\ns = requests.Session()\nassert s.get('http://localhost:7878/').ok  # then login first\ns.post('http://localhost:7878/auth/login', data={'username': u})","typeGuard":null,"tryCatchPattern":"try:\n    r = s.post(url, json=payload, timeout=30)\n    r.raise_for_status()\nexcept requests.HTTPError as e:\n    if e.response.status_code == 401:\n        login_and_retry()","preventionTips":["Always login and reuse the session (cookie jar) for UI endpoints","Watch for server restarts or SECRET_KEY changes invalidating sessions","Don't send API-token-style requests to the web session endpoint"],"tags":["http","auth","session","python","fastapi"],"backgroundTag":"unauthenticated-session-401","analyzedSha":"42d7ab4ab6650433486dfb12eb3783c393a3e475","analyzedAt":"2026-09-01T05:00:32.200Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}