[GH-ISSUE #51] 401 unauthorized on openwebui

bsakaguchi commented

2026-10-18 21:13:38 +00:00

Owner

Originally created by @huntyh on GitHub (Jun 14, 2026).
Original GitHub issue: https://github.com/open-webui/oikb/issues/51

Hello,
After several hours of troubleshooting, I can't get the OIKB daemon to work, as I always get a 401 Unauthorized reply.

Compose:

version: '3.8'

services:
  openwebui:
    image: ghcr.io/open-webui/open-webui:main
    container_name: openwebui
    restart: unless-stopped
    ports:
      - "3000:8080"
    environment:
      - ENABLE_RAG_WEB_SEARCH=False
      - RAG_SYSTEM_CONTEXT=True
    volumes:
      - /storage/docker/openwebui_data:/app/backend/data

  oikb:
    image: ghcr.io/open-webui/oikb:latest
    container_name: oikb
    restart: unless-stopped
    ports:
      - "3001:8080"
    environment:
      - OPEN_WEBUI_URL=[url on internal network]
      - OPEN_WEBUI_API_KEY=sk-[key]
      - OIKB_API_KEY=[key]
      - GITLAB_TOKEN=[gitlab token]
      - GITLAB_URL=[gitlab url]
      - LOG_FORMAT=json
    volumes:
      - /storage/docker/oikb_data/oikb-config.yaml:/data/.oikb.yaml:ro
    command: daemon
    depends_on:
      - openwebui
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health/ready"]
      interval: 30s
      timeout: 5s

Config:

 1 version: "1"
 2
 3 defaults:
 4   interval: "30m"
 5   concurrency: "4"
 6   filter:
 7     max-size: "50mb"
 8
 9 sources:
10   - name: "gitlab-ai-docs"
11     source: "gitlab:root/wiki"                  
12     branch: "main"                              
13     path: "internal-tools/ai/"                  
14     kb-id: "[kb_id]" 
15     token: "${GITLAB_TOKEN}"               
16     filter:
17       include:
18         - "**/*.md"
19         - "**/*.html"

I tried both the sk-[key] and the JWT token, none of them work and I always get 401. The api key was created with my admin account, the knowledge base has global write access enabled, nothing I try works.

I noticed that if I use CURL with my api key on the host machine, i get 401s, but if I use CURL with my JWT token on the host machine, it goes through.

Originally created by @huntyh on GitHub (Jun 14, 2026). Original GitHub issue: https://github.com/open-webui/oikb/issues/51 Hello, After several hours of troubleshooting, I can't get the OIKB daemon to work, as I always get a 401 Unauthorized reply. **Compose:** ```yaml version: '3.8' services: openwebui: image: ghcr.io/open-webui/open-webui:main container_name: openwebui restart: unless-stopped ports: - "3000:8080" environment: - ENABLE_RAG_WEB_SEARCH=False - RAG_SYSTEM_CONTEXT=True volumes: - /storage/docker/openwebui_data:/app/backend/data oikb: image: ghcr.io/open-webui/oikb:latest container_name: oikb restart: unless-stopped ports: - "3001:8080" environment: - OPEN_WEBUI_URL=[url on internal network] - OPEN_WEBUI_API_KEY=sk-[key] - OIKB_API_KEY=[key] - GITLAB_TOKEN=[gitlab token] - GITLAB_URL=[gitlab url] - LOG_FORMAT=json volumes: - /storage/docker/oikb_data/oikb-config.yaml:/data/.oikb.yaml:ro command: daemon depends_on: - openwebui healthcheck: test: ["CMD", "curl", "-f", "http://localhost:8080/health/ready"] interval: 30s timeout: 5s ``` **Config:** ```yaml 1 version: "1" 2 3 defaults: 4 interval: "30m" 5 concurrency: "4" 6 filter: 7 max-size: "50mb" 8 9 sources: 10 - name: "gitlab-ai-docs" 11 source: "gitlab:root/wiki" 12 branch: "main" 13 path: "internal-tools/ai/" 14 kb-id: "[kb_id]" 15 token: "${GITLAB_TOKEN}" 16 filter: 17 include: 18 - "**/*.md" 19 - "**/*.html" ``` I tried both the sk-[key] and the JWT token, none of them work and I always get 401. The api key was created with my admin account, the knowledge base has global write access enabled, nothing I try works. I noticed that if I use CURL with my api key on the host machine, i get 401s, but if I use CURL with my JWT token on the host machine, it goes through.

bsakaguchi commented

2026-10-18 21:13:39 +00:00

Author

Owner

@omeganot commented on GitHub (Jun 17, 2026):

I just ran into this issue myself. I think it's parsing the token oddly. After reading through the code (and I'm not great at Python) it seems like there's a chance in the resolve_token method (config.py) that the OPEN_WEBUI_API_KEY doesn't actually get used. I think when the OikbClient gets created it could be passing an empty string for the token somewhere, thus overriding the environment variable (which comes second in resolve_token). That leads to the 401 error.

What fixed it for me was providing the API key for my account from Open WebUI (not the JWT) as the token parameter under that git source. Which is bonkers. But, it worked. I provided the GITHUB_TOKEN through the environment variable, and the OWUI token in my .oikb.yaml file where you have ${GITLAB_TOKEN}.

This would also mean you can only authenticate with one GitHub account and one GitLab account, which each have access to any repo you want to sync, as those have to be environment variables.

@omeganot commented on GitHub (Jun 17, 2026): I just ran into this issue myself. I think it's parsing the token oddly. After reading through the code (and I'm not great at Python) it seems like there's a chance in the resolve_token method (config.py) that the OPEN_WEBUI_API_KEY doesn't actually get used. I think when the OikbClient gets created it could be passing an empty string for the token somewhere, thus overriding the environment variable (which comes second in resolve_token). That leads to the 401 error. What fixed it for me was providing the API key for my account from Open WebUI (not the JWT) as the token parameter under that git source. Which is bonkers. But, it worked. I provided the GITHUB_TOKEN through the environment variable, and the OWUI token in my .oikb.yaml file where you have ${GITLAB_TOKEN}. This would also mean you can only authenticate with one GitHub account and one GitLab account, which each have access to any repo you want to sync, as those have to be environment variables.

bsakaguchi commented

2026-10-18 21:13:39 +00:00

Author

Owner

@silentoplayz commented on GitHub (Jun 19, 2026):

Confirming this issue on oikb 0.3.5 + Open WebUI 0.9.6 (dev).

Symptoms: Initial sync via /api/v1/files/ succeeds (all 295 files uploaded), but subsequent incremental syncs fail with 401 Unauthorized on POST /api/v1/knowledge/{id}/sync/diff.

Debugging steps that narrowed it down:

The same API key works when calling /sync/diff directly from another container on the same Docker network via curl — returns 200 OK
The same API key works for all other Open WebUI API endpoints from the oikb container
Only the oikb client's request to /sync/diff returns 401

Root cause: As @omeganot identified, the token: field in the source config (intended for the source connector, e.g. GITHUB_TOKEN) appears to override OPEN_WEBUI_API_KEY when oikb constructs the request to the /sync/diff endpoint.

Workaround: Remove token: from the source config entirely. The GitHub/GitLab token is still picked up from the environment variable automatically.

# ❌ Breaks sync/diff auth
sources:
  - name: docs
    source: github:open-webui/docs
    token: ${GITHUB_TOKEN}  # This overrides OPEN_WEBUI_API_KEY

# ✅ Works correctly  
sources:
  - name: docs
    source: github:open-webui/docs
    # GITHUB_TOKEN picked up from env automatically

@silentoplayz commented on GitHub (Jun 19, 2026): **Confirming this issue on oikb 0.3.5 + Open WebUI 0.9.6 (dev).** **Symptoms:** Initial sync via `/api/v1/files/` succeeds (all 295 files uploaded), but subsequent incremental syncs fail with `401 Unauthorized` on `POST /api/v1/knowledge/{id}/sync/diff`. **Debugging steps that narrowed it down:** - The same API key works when calling `/sync/diff` directly from another container on the same Docker network via `curl` — returns `200 OK` - The same API key works for all other Open WebUI API endpoints from the oikb container - Only the oikb client's request to `/sync/diff` returns 401 **Root cause:** As @omeganot identified, the `token:` field in the source config (intended for the *source* connector, e.g. `GITHUB_TOKEN`) appears to override `OPEN_WEBUI_API_KEY` when oikb constructs the request to the `/sync/diff` endpoint. **Workaround:** Remove `token:` from the source config entirely. The GitHub/GitLab token is still picked up from the environment variable automatically. ```yaml # ❌ Breaks sync/diff auth sources: - name: docs source: github:open-webui/docs token: ${GITHUB_TOKEN} # This overrides OPEN_WEBUI_API_KEY # ✅ Works correctly sources: - name: docs source: github:open-webui/docs # GITHUB_TOKEN picked up from env automatically ```

bsakaguchi commented

2026-10-18 21:13:39 +00:00

Author

Owner

@omeganot commented on GitHub (Jun 20, 2026):

@silentoplayz - Thanks for the tip on removing the token variable from the config. I'll give that a try too. Still an error here between intention and implementation, it seems, but this is another good workaround for now.

@omeganot commented on GitHub (Jun 20, 2026): @silentoplayz - Thanks for the tip on removing the token variable from the config. I'll give that a try too. Still an error here between intention and implementation, it seems, but this is another good workaround for now.

Rows
Columns

[GH-ISSUE #51] 401 unauthorized on openwebui #31