Open WebUI vs TextGen

Open WebUI

Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry.

TextGen

AGPL-3.0 with no telemetry, and a local API on 127.0.0.1:5000 that checks the Host header, limits CORS to localhost and separates an admin key from the caller's key. No release since v4.9 on 20 May 2026, no code commits since 31 May, no test suite, and ten security advisories in the year, all fixed.

Open WebUI

1. Ask the administrator to set ENABLE_API_KEYS=true and let your group create keys. sk- keys are refused until then
2. Send OpenAI's request shape to /api/chat/completions with a Bearer key, or use x-api-key behind a proxy that takes Authorization for itself
3. Call /api/models first and use an id from it. Model IDs depend on the instance's connections
4. Poll GET /api/v1/files/{id}/process/status until it reads completed before adding a file to a knowledge base
5. Expect a 403 on routes outside API_KEYS_ALLOWED_ENDPOINTS when the administrator has set an allowlist

TextGen

1. Ask the owner to launch with --api. Nothing listens on port 5000 without it, and a model must be loaded first
2. Call http://127.0.0.1:5000/v1. Any Host header other than localhost or 127.0.0.1 gets 400 Invalid host header unless --listen is set
3. Send the key as Authorization: Bearer on OpenAI routes and as x-api-key on /v1/messages. Model loading needs the admin key
4. Read http://127.0.0.1:5000/docs or modules/api/typing.py for parameters. max_tokens defaults to 512 on chat completions
5. Run tool calls yourself. The API returns finish_reason: "tool_calls" and executes nothing on the server
6. Use the repository name oobabooga/textgen. The old text-generation-webui URL redirects