Skip to main content

Share Open WebUI with Your Team

Share one Open WebUI instance so your team can use connected models from their browsers. Configure network access, accounts, and permissions before inviting users.

Open WebUI is built to be shared. A single instance can serve your whole organization. Users just open a browser and start chatting. No per-seat installs, no client-side dependencies, no fragmented data across machines.

Set up a small team​

Start with an administrator account and a model endpoint the Open WebUI server can reach. A small team can begin with one instance; use the scaling guide when your workload requires more capacity.

  1. Install Open WebUI and connect a model. Confirm that the administrator can send a message and receive an answer.
  2. Choose a network-access option below and check that a teammate can reach the login page. Use HTTPS for remote access.
  3. Approve user accounts or configure SSO with your identity provider.
  4. Create groups and grant access to the appropriate models and knowledge bases. Review default and group permissions together: permissions are additive.
  5. Sign in as a regular user and follow the access checks at the end of this page. An administrator's view does not prove that a teammate has the intended access.

Sharing an instance does not automatically share everyone's documents or conversations. Grant access to knowledge bases explicitly, and use chat sharing when you want to share a conversation snapshot.

Built for Teams​

Streamlined Onboarding​

End users don't need to install anything, manage Docker, or touch a terminal. They open a browser, navigate to your instance URL, and log in.

Collaborative Intelligence​

A shared instance means shared knowledge.

ChannelsPersistent spaces where your team and AI models work together in real time
Shared ChatsSend an exact conversation snapshot to a colleague. A share link is private to the users and groups you grant; instance-wide or no-sign-in links need the public-sharing and open-sharing chat permissions, which are off by default for non-admin users
Global Prompts & KnowledgeBuild specialized agents and make them instantly available to everyone

The share dialog can also upload a chat to the Open WebUI Community site. Turn off Community Sharing in Admin Panel > Settings > General (or set ENABLE_COMMUNITY_SHARING=false before the first start) to keep everything in-house.

Shared Compute​

When running local models, a single powerful server (or cluster) serves your entire team instead of requiring capable hardware on every desk.

Centralized Administration​

Manage everything from one place: control which models users can access, configure Role-Based Access Control (RBAC), review audit logs, and restrict features as needed.

Opening Your Instance to the Team​

To share your instance, you need to make it accessible over a network. There are three common approaches, from simple local access to production-grade public domains.

1. Zero-Config LAN (Local Network)​

If your team is on the same local network or VPN, they can reach Open WebUI using your machine's local IP address and port.

http://192.168.1.100:3000

For remote teams that don't need public internet exposure. Overlay networks and secure tunnels provide encrypted access without opening firewall ports.

TailscalePrivate mesh network with MagicDNS (https://open-webui.tailnet-name.ts.net)
Cloudflare TunnelsExpose via Cloudflare's edge, protected by Cloudflare Access (Zero Trust)
ngrokQuick temporary sharing for development or testing

3. Public HTTPS (Reverse Proxy)​

For production deployments, place Open WebUI behind a reverse proxy for SSL/TLS termination on your own domain (e.g., ai.yourcompany.com).

NginxIndustry standard web server and reverse proxy
CaddyAutomatic HTTPS with minimal configuration
HAProxyHigh-performance load balancing and proxying

Onboarding Your Team​

Once your instance is network-accessible, you need to manage how users create accounts and log in.

The Pending Queue​

The first user to register becomes the Administrator. Creating that first account switches off New Sign Ups in Admin Panel > Settings > Authentication, so others can only register once an admin turns it back on. New accounts then wait in a Pending state, unable to access models or use the platform, until an admin approves them, unless Default User Role there is set to user. DEFAULT_USER_ROLE sets that value only on the first start (after that the saved setting wins), and ENABLE_SIGNUP is overwritten to off when the first account is created.

Enterprise Single Sign-On (SSO)​

For organizations where manual approval doesn't scale, Open WebUI integrates with your existing identity provider.

OAuth / OIDCAuthenticate via Google, Microsoft, Okta, or Keycloak
Group mappingMap IdP groups directly to Open WebUI groups
SCIM 2.0Automated user and group provisioning and deprovisioning

Learn how to set up SSO →

Verify team access​

Using a regular account in the intended group, check that:

  • The permitted model is visible and answers a test message.
  • The shared knowledge base is accessible and answers a question from a test document.
  • A restricted model and a restricted knowledge base are unavailable to that account, including through a direct link.

Repeat with an account outside the group to confirm the restricted resources remain unavailable. Review groups and resource access if either account sees more than intended.

This content is for informational purposes only and does not constitute a warranty, guarantee, or contractual commitment. Open WebUI is provided "as is." See your license for applicable terms.