llama.cpp vs Open WebUI

llama.cpp

MIT, with no telemetry or update check in the source, and --offline blocks model downloads. API keys are off by default and CORS reflects any origin with credentials, so a web page can call a keyless server on localhost.

Open WebUI

Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry.

llama.cpp

1. Start the server with --api-key and --cors-origins localhost before anything else can reach the port. Both are off by default
2. Pass n_predict or max_tokens. Generation is unbounded by default
3. Send response_fields to /completion to drop the fields you don't read
4. Wait and retry on a 503 unavailable_error. The model is still loading
5. Read the server README of the build you run. Behaviour changes between nightly builds without a changelog entry

Open WebUI

1. Ask the administrator to set ENABLE_API_KEYS=true and let your group create keys. sk- keys are refused until then
2. Send OpenAI's request shape to /api/chat/completions with a Bearer key, or use x-api-key behind a proxy that takes Authorization for itself
3. Call /api/models first and use an id from it. Model IDs depend on the instance's connections
4. Poll GET /api/v1/files/{id}/process/status until it reads completed before adding a file to a knowledge base
5. Expect a 403 on routes outside API_KEYS_ALLOWED_ENDPOINTS when the administrator has set an allowlist