[Skip to main content](https://docs.openwebui.com/reference/env-configuration/#__docusaurus_skipToContent_fallback) On this page ## Overview [​](https://docs.openwebui.com/reference/env-configuration/\#overview "Direct link to Overview") Open WebUI provides a large range of environment variables that allow you to customize and configure various aspects of the application. This page serves as a comprehensive reference for all available environment variables, providing their types, default values, and descriptions. As new variables are introduced, this page will be updated to reflect the growing configuration options. info This page is up-to-date with Open WebUI release version [v0.10.0](https://github.com/open-webui/open-webui/releases/tag/v0.10.0), but is still a work in progress to later include more accurate descriptions, listing out options available for environment variables, defaults, and improving descriptions. ### Important Note on `ConfigVar` Environment Variables [​](https://docs.openwebui.com/reference/env-configuration/\#important-note-on-configvar-environment-variables "Direct link to important-note-on-configvar-environment-variables") note When launching Open WebUI for the first time, all environment variables are treated equally and can be used to configure the application. However, for environment variables marked as `ConfigVar`, their values are persisted and stored internally. After the initial launch, if you restart the container, `ConfigVar` environment variables will no longer use the external environment variable values. Instead, they will use the internally stored values. In contrast, regular environment variables will continue to be updated and applied on each subsequent restart. You can update the values of `ConfigVar` environment variables directly from within Open WebUI, and these changes will be stored internally. This allows you to manage these configuration settings independently of the external environment variables. Please note that `ConfigVar` environment variables are clearly marked as such in the documentation below, so you can be aware of how they will behave. To disable this behavior and force Open WebUI to always use your environment variables (ignoring the database), set `ENABLE_PERSISTENT_CONFIG` to `False`. **CRITICAL WARNING:** When `ENABLE_PERSISTENT_CONFIG` is `False`, you may still be able to edit settings in the Admin UI. However, these changes are **NOT saved**. ### Troubleshooting Ignored Environment Variables 🛠️ [​](https://docs.openwebui.com/reference/env-configuration/\#troubleshooting-ignored-environment-variables-%EF%B8%8F "Direct link to Troubleshooting Ignored Environment Variables 🛠️") If you change an environment variable (like `ENABLE_SIGNUP=True`) but don't see the change reflected in the UI (e.g., the "Sign Up" button is still missing), it's likely because a value has already been persisted in the database from a previous run or a persistent Docker volume. #### Option 1: Using `ENABLE_PERSISTENT_CONFIG` (Temporary Fix) [​](https://docs.openwebui.com/reference/env-configuration/\#option-1-using-enable_persistent_config-temporary-fix "Direct link to option-1-using-enable_persistent_config-temporary-fix") Set `ENABLE_PERSISTENT_CONFIG=False` in your environment. This forces Open WebUI to read your variables directly. Note that UI-based settings changes will not persist across restarts in this mode. #### Option 2: Update via Admin UI (Recommended) [​](https://docs.openwebui.com/reference/env-configuration/\#option-2-update-via-admin-ui-recommended "Direct link to Option 2: Update via Admin UI (Recommended)") The simplest and safest way to change `ConfigVar` settings is directly through the **Admin Panel** within Open WebUI. Even if an environment variable is set, changes made in the UI will take precedence and be saved to the database. #### Option 3: Manual Database Update (Last Resort / Lock-out Recovery) [​](https://docs.openwebui.com/reference/env-configuration/\#option-3-manual-database-update-last-resort--lock-out-recovery "Direct link to Option 3: Manual Database Update (Last Resort / Lock-out Recovery)") If you are locked out or cannot access the UI, you can manually update the SQLite database via Docker: ``` docker exec -it open-webui sqlite3 /app/backend/data/webui.db "UPDATE config SET data = json_set(data, '$.ENABLE_SIGNUP', json('true'));" ``` _(Replace `ENABLE_SIGNUP` and `true` with the specific setting and value needed.)_ #### Option 4: Resetting for a Fresh Install [​](https://docs.openwebui.com/reference/env-configuration/\#option-4-resetting-for-a-fresh-install "Direct link to Option 4: Resetting for a Fresh Install") If you are performing a clean installation and want to ensure all environment variables are fresh: 1. Stop the container. 2. Remove the persistent volume: `docker volume rm open-webui`. 3. Restart the container. danger **Warning:** Removing the volume will delete all user data, including chats and accounts. ## App/Backend [​](https://docs.openwebui.com/reference/env-configuration/\#appbackend "Direct link to App/Backend") The following environment variables are used by `backend/open_webui/config.py` to provide Open WebUI startup configuration. Please note that some variables may have different default values depending on whether you're running Open WebUI directly or via Docker. For more information on logging environment variables, see our [logging documentation](https://docs.openwebui.com/getting-started/advanced-topics/logging). ### General [​](https://docs.openwebui.com/reference/env-configuration/\#general "Direct link to General") #### `WEBUI_URL` [​](https://docs.openwebui.com/reference/env-configuration/\#webui_url "Direct link to webui_url") - Type: `str` - Default: `http://localhost:3000` - Description: Specifies the URL where your Open WebUI installation is reachable. Needed for search engine support and OAuth/SSO. - Persistence: This environment variable is a `ConfigVar` variable. warning This variable has to be set before you start using OAuth/SSO for authentication. Since this is a persistent config environment variable, you can only change it through one of the following options: - Temporarily disabling persistent config using `ENABLE_PERSISTENT_CONFIG` - Changing `WEBUI_URL` in the admin panel > settings and changing "WebUI URL". Failure to set WEBUI\_URL before using OAuth/SSO will result in failure to log in. #### `ENABLE_API_OUTLET_FILTERS` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_api_outlet_filters "Direct link to enable_api_outlet_filters") - Type: `bool` - Default: `True` - Description: When enabled, **outlet** [filter functions](https://docs.openwebui.com/features/extensibility/plugin/functions/filter) also run for completions requested directly through the API (both streaming and non-streaming), not only for chats made from the Open WebUI interface. Disable to skip outlet filters on direct API traffic. Inlet filters and other pipeline stages are unaffected. - Persistence: Set via environment variable; applied at startup (not a `ConfigVar`). #### `ENABLE_SIGNUP` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_signup "Direct link to enable_signup") - Type: `bool` - Default: `True` - Description: Toggles user account creation. - Persistence: This environment variable is a `ConfigVar` variable. #### `ENABLE_SIGNUP_PASSWORD_CONFIRMATION` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_signup_password_confirmation "Direct link to enable_signup_password_confirmation") - Type: `bool` - Default: `False` - Description: If set to True, a "Confirm Password" field is added to the sign-up page to help users avoid typos when creating their password. #### `WEBUI_ADMIN_EMAIL` [​](https://docs.openwebui.com/reference/env-configuration/\#webui_admin_email "Direct link to webui_admin_email") - Type: `str` - Default: Empty string (' ') - Description: Specifies the email address for an admin account to be created automatically on first startup when no users exist. This enables headless/automated deployments without manual account creation. When combined with `WEBUI_ADMIN_PASSWORD`, the admin account is created during application startup, and `ENABLE_SIGNUP` is automatically disabled to prevent unauthorized account creation. info This variable is designed for automated/containerized deployments where manual admin account creation is impractical. The admin account is only created if: - No users exist in the database (fresh installation) - Both `WEBUI_ADMIN_EMAIL` and `WEBUI_ADMIN_PASSWORD` are configured After the admin account is created, sign-up is automatically disabled for security. You can re-enable it later via the Admin Panel if needed. #### `WEBUI_ADMIN_PASSWORD` [​](https://docs.openwebui.com/reference/env-configuration/\#webui_admin_password "Direct link to webui_admin_password") - Type: `str` - Default: Empty string (' ') - Description: Specifies the password for the admin account to be created automatically on first startup when no users exist. Must be used in conjunction with `WEBUI_ADMIN_EMAIL`. The password is securely hashed before storage using the same mechanism as manual account creation. danger **Security Considerations** - Use a strong, unique password for production deployments - Consider using secrets management (Docker secrets, Kubernetes secrets, environment variable injection) rather than storing the password in plain text configuration files - After initial setup, change the admin password through the UI for enhanced security - Never commit this value to version control #### `WEBUI_ADMIN_NAME` [​](https://docs.openwebui.com/reference/env-configuration/\#webui_admin_name "Direct link to webui_admin_name") - Type: `str` - Default: `Admin` - Description: Specifies the display name for the automatically created admin account. This is used when `WEBUI_ADMIN_EMAIL` and `WEBUI_ADMIN_PASSWORD` are configured for headless admin creation. #### `ENABLE_LOGIN_FORM` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_login_form "Direct link to enable_login_form") - Type: `bool` - Default: `True` - Description: Toggles email, password, sign-in and "or" (only when `ENABLE_OAUTH_SIGNUP` is set to True) elements. - Persistence: This environment variable is a `ConfigVar` variable. #### `ENABLE_PASSWORD_CHANGE_FORM` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_password_change_form "Direct link to enable_password_change_form") - Type: `bool` - Default: `True` - Description: Controls visibility of the password change UI in **Settings > Account**. When set to `False`, users do not see the password update form, which is useful for SSO-focused deployments where password changes should not be presented in the UI. - Persistence: This environment variable is a `ConfigVar` variable. #### `PASSWORD_HASH_ALGORITHM` [​](https://docs.openwebui.com/reference/env-configuration/\#password_hash_algorithm "Direct link to password_hash_algorithm") - Type: `str` - Default: `bcrypt` - Options: `bcrypt`, `argon2` - Description: Selects the algorithm used to hash new user passwords. `bcrypt` (default) rejects passwords longer than **72 bytes** (a hard bcrypt limit). `argon2` removes that limit and accepts arbitrarily long passwords (requires the `argon2-cffi` package). Existing hashes keep working after a switch: verification auto-detects the algorithm from each stored hash (an `$argon2` prefix verifies with argon2, otherwise bcrypt), so changing this affects only newly set passwords. - Persistence: Set via environment variable; applied at startup (not a `ConfigVar`). #### `ENABLE_PASSWORD_AUTH` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_password_auth "Direct link to enable_password_auth") - Type: `bool` - Default: `True` - Description: Allows both password and SSO authentication methods to coexist when set to True. When set to False, it disables all password-based login attempts on the /signin and /ldap endpoints, enforcing strict SSO-only authentication. Disable this setting in production environments with fully configured SSO to prevent credential-based account takeover attacks; keep it enabled if you require password authentication as a backup or have not yet completed SSO configuration. Should never be disabled if OAUTH/SSO is not being used. This setting controls backend authentication behavior, while `ENABLE_PASSWORD_CHANGE_FORM` controls UI visibility of password-change controls. tip This SHOULD be set to `False` if you only use SSO/OAUTH for Login and expose your Open WebUI publicly as to prevent password based logins. danger This should **only** ever be set to `False` when [ENABLE\_OAUTH\_SIGNUP](https://docs.openwebui.com/reference/env-configuration/#enable_oauth_signup) is also being used and set to `True`. **Never disable this if OAUTH/SSO is not being used.** Failure to do so will result in the inability to login. #### `DEFAULT_LOCALE` [​](https://docs.openwebui.com/reference/env-configuration/\#default_locale "Direct link to default_locale") - Type: `str` - Default: `en` - Description: Sets the default locale for the application. - Persistence: This environment variable is a `ConfigVar` variable. #### `DEFAULT_MODELS` [​](https://docs.openwebui.com/reference/env-configuration/\#default_models "Direct link to default_models") - Type: `str` - Default: Empty string (' '), since `None`. - Description: Sets a default Language Model. - Persistence: This environment variable is a `ConfigVar` variable. #### `DEFAULT_PINNED_MODELS` [​](https://docs.openwebui.com/reference/env-configuration/\#default_pinned_models "Direct link to default_pinned_models") - Type: `str` - Default: Empty string (' ') - Description: Comma-separated list of model IDs to pin by default for new users who haven't customized their pinned models. This provides a pre-selected set of frequently used models in the model selector for new accounts. - Example: `gpt-4,claude-3-opus,llama-3-70b` - Persistence: This environment variable is a `ConfigVar` variable. #### `DEFAULT_MODEL_METADATA` [​](https://docs.openwebui.com/reference/env-configuration/\#default_model_metadata "Direct link to default_model_metadata") - Type: `dict` (JSON object) - Default: `{}` - Description: Sets global default metadata (capabilities and other model info) for all models. These defaults act as a baseline. Per-model overrides always take precedence. For capabilities, the defaults and per-model values are merged (per-model wins on conflicts). For other metadata fields, the default is only applied if the model has no value set. Configurable via **Admin Settings → Models**. - Persistence: This environment variable is a `ConfigVar` variable. Stored at config key `models.default_metadata`. info `DEFAULT_MODEL_METADATA` is read from the environment as a JSON string at startup. - Use valid JSON (for example: `{"capabilities":{"vision":true,"web_search":true}}`) - If parsing fails, Open WebUI logs the error and falls back to `{}` - The parsed value is then applied even when persistent config is disabled, so configured defaults are honored at startup. #### `DEFAULT_MODEL_PARAMS` [​](https://docs.openwebui.com/reference/env-configuration/\#default_model_params "Direct link to default_model_params") - Type: `dict` (JSON object) - Default: `{}` - Description: Sets global default parameters (temperature, top\_p, max\_tokens, seed, etc.) for all models. These defaults are applied as a baseline at chat completion time. Per-model parameter overrides always take precedence. Configurable via **Admin Settings → Models**. - Persistence: This environment variable is a `ConfigVar` variable. Stored at config key `models.default_params`. info `DEFAULT_MODEL_PARAMS` is read from the environment as a JSON string at startup. - Use valid JSON (for example: `{"temperature":0.7,"function_calling":"native"}`) - If parsing fails, Open WebUI logs the error and falls back to `{}` #### `DEFAULT_USER_ROLE` [​](https://docs.openwebui.com/reference/env-configuration/\#default_user_role "Direct link to default_user_role") - Type: `str` - Options: - `pending`: New users are pending until their accounts are manually activated by an admin. - `user`: New users are automatically activated with regular user permissions. - `admin`: New users are automatically activated with administrator permissions. - Default: `pending` - Description: Sets the default role assigned to new users. - Persistence: This environment variable is a `ConfigVar` variable. #### `DEFAULT_GROUP_ID` [​](https://docs.openwebui.com/reference/env-configuration/\#default_group_id "Direct link to default_group_id") - Type: `str` - Default: Empty string (' ') - Description: Sets the default group ID to assign to new users upon registration. - Persistence: This environment variable is a `ConfigVar` variable. #### `DEFAULT_GROUP_SHARE_PERMISSION` [​](https://docs.openwebui.com/reference/env-configuration/\#default_group_share_permission "Direct link to default_group_share_permission") - Type: `str` - Options: `members`, `true`, `false` - Default: `members` - Description: Controls the default "Who can share to this group" setting for newly created groups. `members` means only group members can share to the group, `true` means anyone can share, and `false` means no one can share to the group. This applies both to groups created manually and groups created automatically (e.g. via SCIM or OAuth group sync). Existing groups are not affected; this only sets the initial default for new groups. #### `PENDING_USER_OVERLAY_TITLE` [​](https://docs.openwebui.com/reference/env-configuration/\#pending_user_overlay_title "Direct link to pending_user_overlay_title") - Type: `str` - Default: Empty string (' ') - Description: Sets a custom title for the pending user overlay. - Persistence: This environment variable is a `ConfigVar` variable. #### `PENDING_USER_OVERLAY_CONTENT` [​](https://docs.openwebui.com/reference/env-configuration/\#pending_user_overlay_content "Direct link to pending_user_overlay_content") - Type: `str` - Default: Empty string (' ') - Description: Sets a custom text content for the pending user overlay. - Persistence: This environment variable is a `ConfigVar` variable. #### `ENABLE_CALENDAR` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_calendar "Direct link to enable_calendar") - Type: `bool` - Default: `True` - Description: Enables or disables the Calendar feature. When enabled, users can create calendars, manage events, and share calendars with other users or groups via access grants. Active automations are automatically surfaced as virtual events on a dedicated "Scheduled Tasks" calendar. Requires the `features.calendar` user permission (admins always pass). - Persistence: This environment variable is a `ConfigVar` variable. #### `ENABLE_CHANNELS` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_channels "Direct link to enable_channels") - Type: `bool` - Default: `False` - Description: Enables or disables channel support. - Persistence: This environment variable is a `ConfigVar` variable. #### `ENABLE_FOLDERS` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_folders "Direct link to enable_folders") - Type: `bool` - Default: `True` - Description: Enables or disables the folders feature, allowing users to organize their chats into folders in the sidebar. - Persistence: This environment variable is a `ConfigVar` variable. #### `FOLDER_MAX_FILE_COUNT` [​](https://docs.openwebui.com/reference/env-configuration/\#folder_max_file_count "Direct link to folder_max_file_count") - Type: `int` - Default: `("") empty string` - Description: Sets the maximum number of files processing allowed per folder. - Persistence: This environment variable is a `ConfigVar` variable. It can be configured in the **Admin Panel > Settings > General > Folder Max File Count**. Default is none (empty string) which is unlimited. #### `ENABLE_AUTOMATIONS` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_automations "Direct link to enable_automations") - Type: `bool` - Default: `True` - Description: Enables or disables the Automations feature globally. When disabled, the scheduler skips automation processing, the automation API endpoints return `403 Forbidden`, automation builtin tools are not injected, and the Automations entry is hidden from the sidebar. Requires the `features.automations` user permission (admins always pass). - Persistence: This environment variable is a `ConfigVar` variable. #### `AUTOMATION_MAX_COUNT` [​](https://docs.openwebui.com/reference/env-configuration/\#automation_max_count "Direct link to automation_max_count") - Type: `int` - Default: `("") empty string` (unlimited) - Description: Sets the maximum number of automations a non-admin user can create. When set to a positive integer, users who reach this limit will receive a `403 Forbidden` error when attempting to create additional automations. Admins bypass this limit. - Persistence: This environment variable is a `ConfigVar` variable. #### `AUTOMATION_MIN_INTERVAL` [​](https://docs.openwebui.com/reference/env-configuration/\#automation_min_interval "Direct link to automation_min_interval") - Type: `int` (seconds) - Default: `("") empty string` (no minimum) - Description: Sets the minimum allowed interval in seconds between automation recurrences for non-admin users. When set, any automation schedule that recurs more frequently than this value will be rejected with a `400 Bad Request` error. One-time automations (`COUNT=1`) are exempt from this check. Admins bypass this limit. - Persistence: This environment variable is a `ConfigVar` variable. #### `AUTOMATION_AUTH_TOKEN_EXPIRES_IN` [​](https://docs.openwebui.com/reference/env-configuration/\#automation_auth_token_expires_in "Direct link to automation_auth_token_expires_in") - Type: `str` (duration) - Default: `1h` - Description: Lifetime of the short-lived auth token an automation uses to call back into Open WebUI while running headless (so a scheduled run can reach session-authenticated tools and terminals). Accepts duration strings like `30m`, `1h`, `24h`. - Persistence: Set via environment variable; applied at startup (not a `ConfigVar`). Common values for AUTOMATION\_MIN\_INTERVAL | Value | Meaning | | --- | --- | | `60` | Minimum 1 minute between runs | | `300` | Minimum 5 minutes between runs | | `900` | Minimum 15 minutes between runs | | `3600` | Minimum 1 hour between runs | #### `SCHEDULER_POLL_INTERVAL` [​](https://docs.openwebui.com/reference/env-configuration/\#scheduler_poll_interval "Direct link to scheduler_poll_interval") - Type: `int` (seconds) - Default: `10` - Description: Sets the interval in seconds between scheduler ticks. The unified scheduler handles both automation execution and calendar event alerts. Accepts `AUTOMATION_POLL_INTERVAL` as a legacy fallback. #### `CALENDAR_ALERT_LOOKAHEAD_MINUTES` [​](https://docs.openwebui.com/reference/env-configuration/\#calendar_alert_lookahead_minutes "Direct link to calendar_alert_lookahead_minutes") - Type: `int` (minutes) - Default: `10` - Description: Default lookahead window in minutes for calendar event alerts. Events starting within this window from the current time will trigger toast and webhook notifications. Individual events can override this via the **Reminder** setting in the event editor (`meta.alert_minutes`). #### `ENABLE_NOTES` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_notes "Direct link to enable_notes") - Type: `bool` - Default: `True` - Description: Enables or disables the notes feature, allowing users to create and manage personal notes within Open WebUI. - Persistence: This environment variable is a `ConfigVar` variable. #### `ENABLE_MEMORIES` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_memories "Direct link to enable_memories") - Type: `bool` - Default: `True` - Description: Enables or disables the [memory feature](https://docs.openwebui.com/features/chat-conversations/memory), allowing models to store and retrieve long-term information about users. - Persistence: This environment variable is a `ConfigVar` variable. #### `ENABLE_MEMORY_SYSTEM_CONTEXT` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_memory_system_context "Direct link to enable_memory_system_context") - Type: `bool` - Default: `True` - Description: When the [memory feature](https://docs.openwebui.com/features/chat-conversations/memory) is on, controls whether stored memories are injected into the model's system context. Set to `False` to keep the memory tools available (the model can still add, update and delete memories) while no longer adding remembered context to the prompt. Surfaced as the "Memory System Context" toggle under **Admin Settings > General** when Memories is enabled. - Persistence: This environment variable is a `ConfigVar` variable. #### `WEBHOOK_URL` [​](https://docs.openwebui.com/reference/env-configuration/\#webhook_url "Direct link to webhook_url") - Type: `str` - Description: Sets a webhook for integration with Discord/Slack/Microsoft Teams. - Persistence: This environment variable is a `ConfigVar` variable. Admin posture toggles vs. security boundaries The `ENABLE_ADMIN_*` and `BYPASS_ADMIN_ACCESS_CONTROL` toggles in this section control what the admin sees and does **through Open WebUI's admin product surfaces** (admin panel pages, the chat model selector, workspace lists, the export action). They do **not** establish a security boundary against the admin themselves. Open WebUI is single-tenant by architecture and the `admin` role is root-equivalent on the deployment by deliberate design. Admins inherently retain unconstrained access to all data via direct database access, environment-variable inspection, server access, admin-only **Functions** (which execute arbitrary Python at module-import inside the application process), and **Tools** with the `workspace.tools` permission (which the admin can grant to themselves and which run `exec()` on the server). These toggles are appropriate for: - **Performance**: keeping admin-facing list/selector surfaces fast on large multi-user deployments where loading every user's items is a hard performance problem. - **UI clutter reduction**: keeping those same surfaces usable when populated with thousands of items from other users. - **Compliance posture**: meeting requirements (especially in jurisdictions with stronger labour-protection law, e.g. DE / AT / EU) that admins not be _casually_ presented with other users' data, even though they remain technically able to reach it via the routes above. These toggles are **not** appropriate for: - Cross-tenant data isolation between admins. There is no cryptographic per-tenant isolation, no multi-database split, and no per-admin scope on the underlying data store. For genuine tenant separation, the supported pattern is **separate Open WebUI instances per tenant**. - A security boundary against an admin who is determined to read data they aren't shown in their UI surfaces. Treat anything in this cluster as _what the admin sees and does in the product UI and API_, not _what the admin technically can reach on the deployment_. #### `ENABLE_ADMIN_EXPORT` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_admin_export "Direct link to enable_admin_export") - Type: `bool` - Default: `True` - Description: Controls whether the admin-panel **export** action is available (data, chats, and database export). When disabled, the export endpoints reject requests. Database exports only work for SQLite databases for now. Note that admin retains the underlying ability to dump the database directly via deployment access; this toggle controls the in-product export surface, see the admin-posture-toggles note above. Requires a restart to take effect. #### `ENABLE_ADMIN_CHAT_ACCESS` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_admin_chat_access "Direct link to enable_admin_chat_access") - Type: `bool` - Default: `True` - Description: Controls whether the admin-panel **other-users-chats** access surface is available. When disabled, admins can no longer access other users' chats in the admin panel and the corresponding endpoints reject the request. If you disable this, consider also disabling `ENABLE_ADMIN_EXPORT` (especially on SQLite), since exports include user chats and would re-open the same data on a different surface. Note that admin retains underlying database access regardless; this toggle controls the in-product surface, see the admin-posture-toggles note above. #### `ENABLE_ADMIN_ANALYTICS` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_admin_analytics "Direct link to enable_admin_analytics") - Type: `bool` - Default: `True` - Description: Controls whether the admin-panel **Analytics** tab is visible and the analytics API router is mounted. When set to `False`, the tab is hidden and the corresponding endpoints are not registered. Disabling does not stop the underlying data being collected, and admin retains the ability to query that data directly from the database; this toggle controls the in-product surface, see the admin-posture-toggles note above. Requires a restart to take effect. #### `BYPASS_ADMIN_ACCESS_CONTROL` [​](https://docs.openwebui.com/reference/env-configuration/\#bypass_admin_access_control "Direct link to bypass_admin_access_control") - Type: `bool` - Default: `True` - Description: Controls whether admin users see other users' workspace items in **list and selector UI surfaces** (workspace tabs for models / knowledge / prompts / tools / notes / skills, the chat model selector, the file browser list, etc.). When set to `True` (default), those surfaces show every item from every user, convenient for single-admin / small-team deployments. When set to `False`, those same surfaces show only the admin's own items plus items explicitly shared with them, matching what a regular user would see. Per-id direct-access endpoints (`GET /api/v1//id/{id}` and the corresponding update / delete / access-update routes) are **intentionally not gated** by this flag and were never designed to be. Gating them would protect against nothing the admin couldn't trivially do via the database query they used to obtain the resource ID in the first place, while breaking legitimate flows where an admin operates on a known item ID. See the admin-posture-toggles note above for the full architectural reasoning. This environment variable deprecates `ENABLE_ADMIN_WORKSPACE_CONTENT_ACCESS`. If you are still using `ENABLE_ADMIN_WORKSPACE_CONTENT_ACCESS`, switch to `BYPASS_ADMIN_ACCESS_CONTROL`. #### `ENABLE_USER_WEBHOOKS` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_user_webhooks "Direct link to enable_user_webhooks") - Type: `bool` - Default: `False` - Description: Enables or disables user webhooks (each user can set a URL their notifications are POSTed to). For SSRF safety, webhook URLs that resolve to private or reserved IPs are blocked unless [`ENABLE_RAG_LOCAL_WEB_FETCH`](https://docs.openwebui.com/reference/env-configuration/#enable_rag_local_web_fetch) is `true`. - Persistence: This environment variable is a `ConfigVar` variable. #### `RESPONSE_WATERMARK` [​](https://docs.openwebui.com/reference/env-configuration/\#response_watermark "Direct link to response_watermark") - Type: `str` - Default: Empty string (' ') - Description: Sets a custom text that will be included when you copy a message in the chat. e.g., `"This text is AI generated"` -\> will add "This text is AI generated" to every message, when copied. - Persistence: This environment variable is a `ConfigVar` variable. #### `IFRAME_CSP` [​](https://docs.openwebui.com/reference/env-configuration/\#iframe_csp "Direct link to iframe_csp") - Type: `str` - Default: Empty string (no CSP injected) - Description: Sets a Content-Security-Policy applied to all `srcdoc` iframes rendered in the UI: Artifacts, code/HTML previews, file previews, and citation modals. When set, a `` tag is injected at the top of the iframe document, restricting what LLM-generated or user-uploaded HTML can load and execute (network connections, scripts, styles, fonts, frames). The `sandbox` attribute on the iframe still provides the baseline isolation; this CSP is an additional defense-in-depth layer for deployments that need to constrain outbound network requests from rendered HTML. Example value: `default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob:; connect-src 'none'`. Leave unset to keep the existing behavior (sandbox-only). #### `THREAD_POOL_SIZE` [​](https://docs.openwebui.com/reference/env-configuration/\#thread_pool_size "Direct link to thread_pool_size") - Type: `int` - Default: `0` (unset, the AnyIO default limit of `40` applies) - Description: Sets the maximum number of **concurrent** blocking operations that may run in the AnyIO worker thread pool at once. Open WebUI offloads synchronous/blocking work (many DB calls, file I/O, sync route handlers, some library calls) to this pool via `run_in_threadpool`. The value is a **concurrency ceiling (a token limit), not a fixed pool of pre-spawned OS threads and not a CPU-core/thread count**: worker threads are created lazily only when needed and reused, so a high value does **not** by itself create that many threads, consume CPU, or cause CPU contention while idle. It only raises how many blocking operations can be in flight simultaneously before the rest must queue. Set this high on any real server (2000+); never lower it The AnyIO default of `40` is far too low for production. When more than `THREAD_POOL_SIZE` blocking operations are needed at once (many users acting at the same time, or a few users each triggering several blocking calls), every further request **waits** for a free slot. The symptom is the whole app appearing to **hang / freeze / stop responding** under load, even though CPU and memory look fine. It is pool starvation, not resource exhaustion. - **Normal servers / production:**`2000` or higher. `2000` is a _lower_ bound for very large multi-user instances; going higher is fine and is **not** a CPU or contention risk (it is a ceiling, not a preallocation). - **Never decrease below the default.** An idle high ceiling costs effectively nothing; a low ceiling causes freezes. - **Exception, weak hardware (Raspberry Pi, tiny VPS, containers capped at ~250m CPU / very low RAM):** do **not** set `2000` here. Each _genuinely concurrent_ blocking op still uses a real OS thread (stack memory), so on a tiny device an enormous ceiling lets a traffic burst spawn enough threads to exhaust RAM. Leave it at the default, or set a modest value (e.g. a few hundred) matched to what the device can actually absorb. This caveat applies only to constrained single-board / micro deployments; any normal server should use `2000+`. #### `ENABLE_CUSTOM_MODEL_FALLBACK` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_custom_model_fallback "Direct link to enable_custom_model_fallback") - Type: `bool` - Default: `False` - Description: Controls whether custom models should fall back to a default model if their assigned base model is missing. When set to `True`, if a custom model's base model is not found, the system will use the first model from the configured `DEFAULT_MODELS` list instead of returning an error. #### `SHOW_ADMIN_DETAILS` [​](https://docs.openwebui.com/reference/env-configuration/\#show_admin_details "Direct link to show_admin_details") - Type: `bool` - Default: `True` - Description: Toggles whether to show admin user details in the interface. - Persistence: This environment variable is a `ConfigVar` variable. #### `ENABLE_PUBLIC_ACTIVE_USERS_COUNT` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_public_active_users_count "Direct link to enable_public_active_users_count") - Type: `bool` - Default: `True` - Description: Controls whether the active user count is visible to all users or restricted to administrators only. When set to `False`, only admin users can see how many users are currently active, reducing backend load and addressing privacy concerns in large deployments. - Persistence: This environment variable is a `ConfigVar` variable. #### `ENABLE_USER_STATUS` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_user_status "Direct link to enable_user_status") - Type: `bool` - Default: `True` - Description: Globally enables or disables user status functionality. When disabled, the status UI (including blinking active/away indicators and status messages) is hidden across the application, and user status API endpoints are restricted. - Persistence: This environment variable is a `ConfigVar` variable. It can be toggled in the **Admin Panel > Settings > General > User Status**. #### `ENABLE_EASTER_EGGS` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_easter_eggs "Direct link to enable_easter_eggs") - Type: `bool` - Default: `True` - Description: Enables or disables easter egg features in the UI, such as special themes (e.g., the "Her" theme option in the theme selector). Set to `False` to hide these optional novelty features from users. #### `ADMIN_EMAIL` [​](https://docs.openwebui.com/reference/env-configuration/\#admin_email "Direct link to admin_email") - Type: `str` - Description: Sets the admin email shown by `SHOW_ADMIN_DETAILS` - Persistence: This environment variable is a `ConfigVar` variable. #### `ENV` [​](https://docs.openwebui.com/reference/env-configuration/\#env "Direct link to env") - Type: `str` - Options: - `dev`: Enables the FastAPI API documentation on `/docs` - `prod`: Automatically configures several environment variables - Default: - **Backend Default**: `dev` - **Docker Default**: `prod` - Description: Environment setting. #### `ENABLE_PERSISTENT_CONFIG` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_persistent_config "Direct link to enable_persistent_config") - Type: `bool` - Default: `True` - Description: Controls whether the system prioritizes configuration saved in the database over environment variables. - **`True` (Default):** Values saved in the **database** (via the Admin UI) take precedence. If a value is set in the UI, the environment variable is ignored for that setting. - **`False`:** **Environment variables** take precedence. The system will _not_ load configuration from the database at startup if an environment variable is present (or it will use the default). - **CRITICAL WARNING:** When set to `False`, you can still seemingly "change" settings in the Admin UI. These changes will apply to the **current running session** but **will be lost upon restart**. The system will revert to the values defined in your environment variables (or defaults) every time it boots up. - **Use Case:** Set this to `False` if you want to strictly manage configuration via a `docker-compose.yaml` or `.env` file and prevent UI changes from persisting across restarts. #### `CUSTOM_NAME` [​](https://docs.openwebui.com/reference/env-configuration/\#custom_name "Direct link to custom_name") - Type: `str` - Description: Sets `WEBUI_NAME` but polls **api.openwebui.com** for metadata. #### `WEBUI_NAME` [​](https://docs.openwebui.com/reference/env-configuration/\#webui_name "Direct link to webui_name") - Type: `str` - Default: `Open WebUI` - Description: Sets the main WebUI name. Appends `(Open WebUI)` if overridden. #### `PORT` [​](https://docs.openwebui.com/reference/env-configuration/\#port "Direct link to port") - Type: `int` - Default: `8080` - Description: Sets the port to run Open WebUI from. info If you're running the application via Python and using the `open-webui serve` command, you cannot set the port using the `PORT` configuration. Instead, you must specify it directly as a command-line argument using the `--port` flag. For example: ``` open-webui serve --port 9999 ``` This will run the Open WebUI on port `9999`. The `PORT` environment variable is disregarded in this mode. #### `ENABLE_REALTIME_CHAT_SAVE` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_realtime_chat_save "Direct link to enable_realtime_chat_save") - Type: `bool` - Default: `False` - Description: When enabled, the system saves each individual chunk of streamed chat data to the database in real time. EXTREME PERFORMANCE RISK: DO NOT ENABLE IN PRODUCTION **It is strongly recommended to NEVER enable this setting in production or multi-user environments.** Enabling `ENABLE_REALTIME_CHAT_SAVE` causes every single token generated by the LLM to trigger a separate database write operation. In a multi-user environment, this will: 1. **Exhaust Database Connection Pools**: Rapid-fire writes will quickly consume all available database connections, leading to "QueuePool limit reached" errors and application-wide freezes. 2. **Severe Performance Impact**: The overhead of thousands of database transactions per minute will cause massive latency for all users. 3. **Hardware Strain**: It creates immense I/O pressure on your storage system. **Keep this set to `False` (the default).** Chats are still saved automatically once generation is complete. This setting is only intended for extreme debugging scenarios or single-user environments where sub-second persistence of every token is more important than stability. #### `ENABLE_CHAT_RESPONSE_BASE64_IMAGE_URL_CONVERSION` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_chat_response_base64_image_url_conversion "Direct link to enable_chat_response_base64_image_url_conversion") - Type: `bool` - Default: `False` - Description: When set to true, it automatically uploads base64-encoded images exceeding 1KB in markdown and converts them into image file URLs to reduce the size of response text. Some multimodal models directly output images as Base64 strings within the Markdown content. This results in larger response bodies, placing strain on CPU, network, Redis, and database resources. #### `ENABLE_IMAGE_CONTENT_TYPE_EXTENSION_FALLBACK` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_image_content_type_extension_fallback "Direct link to enable_image_content_type_extension_fallback") - Type: `bool` - Default: `False` - Description: When enabled, uses a hardcoded extension-to-MIME dictionary as a last-resort fallback when both the system MIME database and the file's stored content type metadata fail to determine the content type of an image. This is primarily useful on minimal container images (e.g., wolfi-base) that lack `/etc/mime.types` and have legacy files without stored content type metadata. Supported extensions include `.webp`, `.png`, `.jpg`, `.jpeg`, `.gif`, `.svg`, `.bmp`, `.tiff`, `.ico`, `.heic`, `.heif`, and `.avif`. #### `ENABLE_PROFILE_IMAGE_URL_FORWARDING` [​](https://docs.openwebui.com/reference/env-configuration/\#enable_profile_image_url_forwarding "Direct link to enable_profile_image_url_forwarding") - Type: `bool` - Default: `True` - Description: Controls whether the user and model profile-image endpoints honor an external `http(s)://` URL stored in `profile_image_url` by issuing a `302 Found` redirect to the original origin. When `False`, the redirect is suppressed and the endpoint falls through to the bundled default image instead. Set to `False` to prevent client-side IP, User-Agent, and Referer leaks to attacker-controlled origins via attacker-stored profile URLs (data URIs and same-origin/static images continue to load normally). Existing deployments that legitimately rely on external profile image URLs (e.g. Gravatar redirects served by upstream identity providers) should keep the default. **This variable is read once at startup; it is not a `ConfigVar` and cannot be changed from the Admin UI.** #### `PROFILE_IMAGE_ALLOWED_MIME_TYPES` [​](https://docs.openwebui.com/reference/env-configuration/\#profile_image_allowed_mime_types "Direct link to profile_image_allowed_mime_types") - Type: `str` (comma-separated MIME types) - Default: `image/png,image/jpeg,image/gif,image/webp` - Description: Allowlist of MIME types accepted when serving a base64 `data:` URI as a profile image. The MIME type is parsed from the data URI prefix and checked against this list before the response is streamed; non-allowlisted types fall through to the bundled default image. Responses also set `X-Content-Type-Options: nosniff` to prevent the browser from sniffing the body into an executable type. SVG is intentionally not in the default list because it can carry inline `