open-webui/open-webui · error · HTTPException

Failed to sign out from the OpenID provider.

Error message

Failed to sign out from the OpenID provider.

What it means

A 500 from the signout endpoint when tearing down the OpenID session fails: the server fetches the provider's .well-known/openid-configuration to build the end_session_endpoint redirect, and any exception (failed fetch, missing config) is caught, logged as 'OpenID signout error', and re-raised as this HTTPException. It carries response.headers so cookies already cleared are still applied.

Source

Thrown at backend/open_webui/routers/auths.py:1023

                                return JSONResponse(
                                    status_code=200,
                                    content={
                                        'status': True,
                                        'redirect_url': f'{logout_url}?id_token_hint={oauth_id_token}'
                                        + (
                                            f'&post_logout_redirect_uri={WEBUI_AUTH_SIGNOUT_REDIRECT_URL}'
                                            if WEBUI_AUTH_SIGNOUT_REDIRECT_URL
                                            else ''
                                        ),
                                    },
                                    headers=response.headers,
                                )
                        else:
                            raise Exception('Failed to fetch OpenID configuration')

            except Exception as e:
                log.error(f'OpenID signout error: {str(e)}')
                raise HTTPException(
                    status_code=500,
                    detail='Failed to sign out from the OpenID provider.',
                    headers=response.headers,
                )

    if WEBUI_AUTH_SIGNOUT_REDIRECT_URL:
        return JSONResponse(
            status_code=200,
            content={
                'status': True,
                'redirect_url': WEBUI_AUTH_SIGNOUT_REDIRECT_URL,
            },
            headers=response.headers,
        )

    return JSONResponse(status_code=200, content={'status': True}, headers=response.headers)

View on GitHub (pinned to 01f4282f1f)

Solutions

1. Check the server log for 'OpenID signout error: ...' to see the underlying request failure.
2. Verify the OIDC provider is up and its discovery URL (issuer + /.well-known/openid-configuration) resolves from the backend host.
3. Confirm the configured OAuth provider issuer/client settings in Admin Panel > Settings > OAuth.
4. As a workaround, sign out locally by clearing the auth cookie; the local session is already invalidated even though the provider redirect failed.

// Before signout redirect, verify the provider discovery doc is reachable
try { await fetch(`${oidcIssuer}/.well-known/openid-configuration`, { signal: AbortSignal.timeout(3000) }); } catch { useLocalSignoutOnly(); }

try { await api.get('/api/v1/auths/signout'); } catch (e) { if (/OpenID/i.test(e.response?.data?.detail)) { clearLocalSession(); window.location = '/'; } else throw e; }

When it happens

Trigger: GET/POST /api/v1/auths/signout with an OAuth/OIDC provider configured while the provider's discovery URL is unreachable, returns invalid JSON, or lacks end_session_endpoint; DNS failure; provider downtime; self-hosted provider with wrong issuer URL.

Common situations: Keycloak/Auth0 instance stopped or moved; firewall blocks the backend's egress to the IdP; issuer URL changed after a provider migration; TLS certificate of the IdP expired.

Related errors

• An internal error occurred during signup.
• An internal error occurred while adding the user.
• Oops! Something went wrong while creating your API key. Plea
• Failed to login: ${popupError.message}
• Failed to acquire access token

AI-assisted analysis of open-webui/open-webui@01f4282f1f (2026-08-14). Data as JSON: /api/errors/916041a652bf2e79. Report an issue: GitHub.