Jan vs Open WebUI

Jan

Apache-2.0, with installers for macOS, Windows and Linux plus Flathub and the Microsoft Store. No release since 0.8.4 on 23 July 2026, while a security fix waits on main.

Open WebUI

Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry.

Jan

1. Ask the owner to start the server (Settings, Local API Server) or run jan serve. Nothing listens until then
2. Call http://127.0.0.1:1337/v1 for the app and localhost:6767/v1 for jan serve. The ports differ
3. Read /openapi.json from the running server, not the spec on the docs site, which describes the retired Cortex API
4. Branch on the status code. Error bodies are plain text
5. Keep the bind at 127.0.0.1 on 0.8.4. Trusted Hosts is ignored on 0.0.0.0 until the next release

Open WebUI

1. Ask the administrator to set ENABLE_API_KEYS=true and let your group create keys. sk- keys are refused until then
2. Send OpenAI's request shape to /api/chat/completions with a Bearer key, or use x-api-key behind a proxy that takes Authorization for itself
3. Call /api/models first and use an id from it. Model IDs depend on the instance's connections
4. Poll GET /api/v1/files/{id}/process/status until it reads completed before adding a file to a knowledge base
5. Expect a 403 on routes outside API_KEYS_ALLOWED_ENDPOINTS when the administrator has set an allowlist