wandb/openui · error · HTTPException

Login required to use OpenUI

Error message

Login required to use OpenUI

What it means

chat_completions guards the OpenAI-compatible chat endpoint: if the request session has no user_id, it raises HTTP 401 'Login required to use OpenUI'. Sessions are cookie-based, so any client that hasn't logged in through the web UI gets rejected.

Source

Thrown at backend/openui/server.py:118

    allow_origins=[config.CORS_ORIGINS],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)


@router.post("/v1/chat/completions", tags=["openui/chat"])
@router.post(
    "/chat/completions",
    tags=["openui/chat"],
)
async def chat_completions(
    request: Request,
    # chat_request: CompletionCreateParams,  # TODO: lots' fo weirdness here, just using raw json
    # ctx: Any = Depends(weave_context),
):
    if request.session.get("user_id") is None:
        raise HTTPException(status_code=401, detail="Login required to use OpenUI")
    user_id = request.session["user_id"]
    yesterday = datetime.now() - timedelta(days=1)
    tokens = Usage.tokens_since(user_id, yesterday.date())
    if config.ENV == config.Env.PROD and tokens > config.MAX_TOKENS:
        raise HTTPException(
            status_code=429,
            detail="You've exceeded our usage quota, come back tomorrow to generate more UI.",
        )
    try:
        data = await request.json()  # chat_request.model_dump(exclude_unset=True)
        input_tokens = count_tokens(data["messages"])
        # TODO: we always assume 4096 max tokens (random fudge factor here)
        data["max_tokens"] = 4096 - input_tokens - 20
        # TODO: refactor all these blocks into one once Ollama supports vision
        # OpenAI Models
        if data.get("model").startswith("gpt"):
            if data["model"] == "gpt-4" or data["model"] == "gpt-4-32k":
                raise HTTPException(status=400, data="Model not supported")

View on GitHub (pinned to 42d7ab4ab6)

Solutions

1. Log in via the OpenUI UI so a valid session cookie is set before calling the endpoint.
2. Send the session cookie with your request (cookies param in requests, credentials: 'include' in fetch).
3. If sessions were invalidated, re-login; if server-side, verify the session middleware secret is stable.
4. Confirm cookie settings (SameSite/Secure) aren't preventing the session cookie from being sent.

Example fix

// before
requests.post('http://localhost:7878/v1/chat/completions', json=payload)
// after
s = requests.Session()
s.post('http://localhost:7878/auth/login', data={'username': u})  # establish session
r = s.post('http://localhost:7878/v1/chat/completions', json=payload)

import requests
s = requests.Session()
assert s.get('http://localhost:7878/').ok  # then login first
s.post('http://localhost:7878/auth/login', data={'username': u})

try:
    r = s.post(url, json=payload, timeout=30)
    r.raise_for_status()
except requests.HTTPError as e:
    if e.response.status_code == 401:
        login_and_retry()

When it happens

Trigger: Calling POST /v1/chat/completions (or similar) without a logged-in session cookie; session cookie expired or cleared; calling from a script/curl without first authenticating; session backend (e.g. signed-cookie secret change) invalidated sessions.

Common situations: Programmatic API clients pointing at the UI endpoint expecting token auth; server restart wiping in-memory sessions; SECRET_KEY rotated, invalidating all cookies; browser blocking third-party/first-party cookies.

Related errors

• You've exceeded our usage quota, come back tomorrow to gener
• Model not supported
• No session found
• body.error.message
• Unexpected response ${r.status}: ${await r.text()}

AI-assisted analysis of wandb/openui@42d7ab4ab6 (2026-09-01). Data as JSON: /api/errors/ec84da882dd8e54b. Report an issue: GitHub.