Guides
How to Configure Open WebUI for Multi-User Access with Permissions
Set up user accounts, roles, and permissions in Open WebUI so the right people access the right models, documents, and settings.
How to Configure Open WebUI for Multi-User Access with Permissions
As soon as more than one person uses your Open WebUI instance, you need user accounts and permissions. Without them, every user sees every model, every uploaded document, and every setting change. For teams, families, or small organisations, proper access control is essential.
This guide covers setting up users, configuring roles, controlling document visibility, and securing your Open WebUI deployment.
Understanding Open WebUI Roles
Open WebUI ships with three built-in roles:
| Role | Privileges | Best for |
|------|-----------|----------|
| **Admin** | Full access | Operators and administrators |
| **User** | Chat, assigned models and documents | Regular team members |
| **Guest** | Limited chat, no persistent history | Occasional or external users |
For securing the server before opening registration, read How to Secure a Self-Hosted AI Server.
Enabling Multi-User Mode
Step 1: Configure authentication
```bash
docker run -d \
-p 3000:8080 \
-e WEBUI_AUTH=true \
-e WEBUI_SECRET_KEY=your-random-32-char-key \
-v open-webui-data:/app/backend/data \
ghcr.io/open-webui/open-webui:main
```
Generate a secure key:
```bash
openssl rand -base64 32
```
Step 2: Create admin account
The first user to register becomes the admin.
Step 3: Add additional users
Admins can add users from Admin Panel -> Users. Options include manual creation, self-registration, and OAuth integration.
Controlling Model Access
Admin Settings -> Models lets you control which models each user or group can access.
| Group | Models | Use case |
|-------|--------|----------|
| General | Qwen 3 8B, Phi-4, Gemma 3 | Everyday chat |
| Power users | DeepSeek V4 Pro, Llama 3.1 70B | Complex reasoning |
| Engineering | DeepSeek V4 Pro, Code Llama | Code review |
Document Permissions
Use workspaces for document separation. Upload documents within the workspace where they should be accessible. For workspace configuration, see Open WebUI Workspaces for Team Document Collaboration.
Session and History Management
Each user sees only their own conversation history. Set retention policies:
```bash
-e WEBUI_HISTORY_RETENTION_DAYS=90
```
Securing Registration
```bash
-e WEBUI_REGISTRATION_APPROVAL_REQUIRED=true
```
Monitoring User Activity
The admin panel provides active sessions, per-user usage statistics, and model popularity metrics. For external monitoring, see Monitoring and Logging Chat Histories in Open WebUI.
Conclusion
Multi-user Open WebUI is straightforward once you understand the role hierarchy. Start with admin and user roles, restrict model access by team needs, and use workspaces for document separation.
FAQ
Can I use LDAP or Active Directory?
Open WebUI supports OpenID Connect, which can connect to many identity providers.
Do users share the same Ollama instance?
Yes. All users share the same Ollama backend; access control is at the Open WebUI level.
Can a user be in multiple workspaces?
Yes. Users can be assigned to multiple workspaces and switch between them.
**Sources:**
