What this does

Enables user registration and login so that access to the local AI interface is restricted to authenticated users only. After completion, all traffic passes through a secure session-based login flow.

Steps

Stop the Open WebUI service. The service must be halted before editing configuration to avoid overwriting changes on restart.
```
docker stop open-webui
```
Expected output: Container name returned, confirming it stopped.
Add authentication environment variables. Set WEBUI_AUTH_ENABLED=true to activate the built-in auth module.
```
docker run -d -p 3000:8080 \
  -e WEBUI_AUTH_ENABLED=true \
  --name open-webui \
  ghcr.io/open-webui/open-webui:main
```
Expected output: Container starts with authentication active.
Create the first admin account. Navigate to the web interface and register the initial user. This user becomes the admin.
Adjust registration policy (optional). In Settings > Admin Panel > Security, toggle whether new signups require admin approval.

Verification

curl -s -o /dev/null -w "%{http_code}" http://localhost:3000/
# Expected: 200 (redirects to /auth/login if auth is active)

Common failures

Auth variable not set — Environment variable not passed to the container. Double-check the -e flag placement.
Port 3000 already in use — Another service occupies the port. Map to a different port with -p 8080:8080.
Login page not rendering — Reverse proxy or firewall rules block the path. Ensure WebSocket headers are passed.
First user not admin — This occurs when auth was previously disabled and a database already exists. Reset the SQLite database.

Operator checkpoint

Before treating this as solved, write down the local runtime, model or package version, hardware/backend if relevant, and the verification output. This keeps the guide useful as a Will-It-Run style decision instead of a one-off command transcript.

How to enable authentication in Open WebUI

What this does

Steps

Verification

Common failures

Operator checkpoint

Related guides