OpenWebUI vs LibreChat: Which One to Run for a Team

For most teams weighing openwebui vs librechat, pick Open WebUI: it talks to Ollama natively, embeds documents locally by default, and ships OpenTelemetry export and SCIM provisioning. Pick LibreChat when you need an MIT license with no branding clause, SAML, enforced 2FA, or per-user token budgets on paid APIs. Neither stays a single container at team scale.

Install footprint and configuration style are covered in the earlier Open WebUI vs LibreChat comparison. This is the operator’s cut: scale-out requirements, defaults that send data off the box, and a probe for latency the front end adds. Versions at writing: Open WebUI v0.11.4 per its releases page, LibreChat v0.8.8 per its README.

Which should you pick, Open WebUI or LibreChat?

Pick Open WebUI if your models run on your own GPUs behind Ollama or vLLM and you want retrieval that stays on the box, SCIM provisioning and traces without writing an exporter. Pick LibreChat if users mostly hit paid APIs and you need spend ceilings, SAML, enforced 2FA or an unconditional MIT license.

What does each stack need at team scale?

Both become multi-service deployments. Open WebUI’s single container is the quick start, not the production shape: its scaling guide lists PostgreSQL, Redis and an external vector database as required for multiple replicas, set through DATABASE_URL, REDIS_URL with WEBSOCKET_MANAGER=redis, and VECTOR_DB=pgvector or a Chroma HTTP server.

The guide is blunt about the defaults: SQLite across instances produces database is locked errors and corruption, and embedded Chroma’s SQLite backend is not fork-safe. Three settings catch people on the way to replicas:

• WEBUI_SECRET_KEY identical on every replica, or users hit login loops and 401s.
• UVICORN_WORKERS=1 per container; scale by replica count.
• ENABLE_DB_MIGRATIONS=false on all replicas but one.

Open WebUI won’t migrate SQLite data to Postgres, so switch before production data exists. Still on one container? The Docker install guide covers tag pinning and volumes.

LibreChat’s docker-compose.yml defines api, mongodb, meilisearch for conversation search, vectordb on pgvector and rag_api, plus an admin panel. You operate MongoDB from day one. The shape doesn’t change as headcount grows; the cost is a database engine you may not otherwise run.

Auth, provisioning and spend controls

LibreChat’s authentication docs cover email, LDAP/AD, OAuth, OpenID Connect, SAML, passkeys and TOTP. ENFORCE_TWO_FACTOR_AUTHENTICATION=true makes local and LDAP accounts enroll before a full session is issued. ALLOW_REGISTRATION=false closes email sign-up, though OpenID and SAML can’t disable registration alone.

Open WebUI’s SSO page covers Google, Microsoft, GitHub, one generic OIDC provider at a time, and trusted headers from an authenticating proxy; the README adds LDAP/Active Directory and SCIM 2.0. SAML and MFA aren’t on the SSO page, so a SAML-only shop fronts it with a proxy and enforces MFA at the identity provider.

Spend is where LibreChat pulls ahead on paid APIs. Its token usage docs define a balance: block (startBalance, autoRefillEnabled, refillAmount and a refill interval) and log every transaction to a Transactions collection. Open WebUI’s README lists usage dashboards; if finance wants a hard per-user credit ceiling, LibreChat is the one documenting it.

Which one sends documents to OpenAI by default?

LibreChat, until you change one variable. Its RAG API configuration defaults EMBEDDINGS_PROVIDER to openai, with azure, huggingface, huggingfacetei and ollama as alternatives. Open WebUI embeds locally with sentence-transformers/all-MiniLM-L6-v2 into Chroma, as the RAG upload walkthrough details; its slim image is the exception and needs an external engine.

For regulated or air-gapped deployments, set EMBEDDINGS_PROVIDER=ollama and OLLAMA_BASE_URL before the first upload. Changing embedding models later means re-embedding the corpus in either stack; vectors from different models aren’t comparable.

Ownership and license

ClickHouse acquired LibreChat on November 4, 2025, and says it “remains 100% open-source” under MIT, with “nothing changes” for existing deployments. The casualty was the paid, hosted Code Interpreter API, slated for discontinuation in its current form with a May 1, 2026 target.

Open WebUI’s license added a branding clause in v0.6.6: you may not alter, remove or obscure Open WebUI branding unless you have 50 or fewer users in a 30-day window, hold an enterprise license, or meet another listed exception. Code through v0.6.5 stays BSD-3. For an internal tool nobody rebrands, that costs nothing; for a white-labeled product, it’s a procurement conversation.

The metric that matters

UI-added time to first token:

ui_overhead_ttft = TTFT(via front end) - TTFT(direct to backend)

Take it on paired, interleaved requests to the same backend model and report p50 and p95 of the differences. Raw TTFT through the UI is the obvious metric and the wrong one: prefill and queueing on the model server dominate it, so it moves whenever vLLM or Ollama gets busy and says nothing about the chat layer. The difference isolates what the front end adds: auth, history loads, retrieval, agent orchestration. Watch p95, not the mean; the Google SRE book explains how averages hide a slow tail.

Wiring it up

Both expose an OpenAI-compatible streaming endpoint. Open WebUI serves /api/chat/completions with a Bearer key from Settings > Account (API reference). LibreChat’s beta Agents API serves /api/agents/v1/chat/completions, where model is an agent ID and keys need the remoteAgents.use and remoteAgents.create permissions. Point an Open WebUI model and a LibreChat agent at the same backend model:

import os
import statistics
import time

import mlflow
from openai import OpenAI

env = os.environ
TARGETS = {  # name: (base_url, api_key, model)
    "direct": (env["BACKEND_URL"], env.get("BACKEND_KEY", "none"), env["BACKEND_MODEL"]),
    "open_webui": (env["OWUI_URL"] + "/api", env["OWUI_KEY"], env["OWUI_MODEL"]),
    "librechat": (env["LC_URL"] + "/api/agents/v1", env["LC_KEY"], env["LC_AGENT_ID"]),
}
clients = {n: (OpenAI(base_url=u, api_key=k, timeout=60), m) for n, (u, k, m) in TARGETS.items()}


def ttft(name: str) -> float:
    client, model = clients[name]
    prompt = f"[{time.time_ns()}] Reply with one word."  # unique prefix, no KV-cache reuse
    start = time.perf_counter()
    stream = client.chat.completions.create(
        model=model,
        messages=[{"role": "user", "content": prompt}],
        stream=True,
        max_tokens=8,
    )
    for chunk in stream:
        if chunk.choices and chunk.choices[0].delta.content:
            elapsed = time.perf_counter() - start
            stream.close()
            return elapsed
    raise RuntimeError(f"{name}: stream ended without content")


overhead = {"open_webui": [], "librechat": []}
mlflow.set_experiment("chat-frontend-overhead")
with mlflow.start_run():
    for _ in range(50):
        base = ttft("direct")
        for ui in overhead:
            overhead[ui].append(ttft(ui) - base)
    for ui, diffs in overhead.items():
        cuts = statistics.quantiles(diffs, n=100)
        mlflow.log_metric(f"{ui}_overhead_ttft_p50_s", cuts[49])
        mlflow.log_metric(f"{ui}_overhead_ttft_p95_s", cuts[94])

For continuous monitoring, Open WebUI’s OpenTelemetry support exports an http.server.duration histogram labeled by http.route, plus traces for routes, SQLAlchemy and Redis. LibreChat’s built-in /metrics endpoint returns 401 until METRICS_SECRET is set and covers Redis and agent startup, not HTTP latency; take that from your reverse proxy.

# docker-compose.override.yml
services:
  open-webui:
    environment:
      - ENABLE_OTEL=true
      - ENABLE_OTEL_TRACES=true
      - ENABLE_OTEL_METRICS=true
      - OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317
      - OTEL_METRICS_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317
      - OTEL_EXPORTER_OTLP_INSECURE=true  # plaintext OTLP inside the compose network
      - OTEL_SERVICE_NAME=open-webui

# prometheus.yml
scrape_configs:
  - job_name: librechat-api
    scheme: https
    metrics_path: /metrics
    authorization:
      type: Bearer
      credentials_file: /etc/prometheus/librechat_metrics_secret
    static_configs:
      - targets: ["librechat.example.com"]

Aggregate buckets before taking the quantile, as the Prometheus histogram guide prescribes. With the usual OTLP-to-Prometheus naming the query is histogram_quantile(0.95, sum by (le, http_route) (rate(http_server_duration_milliseconds_bucket[5m]))); confirm the series name your collector actually emits.

What you’ll see

Treat these as diagnostic starting points, not measured results. A healthy overhead series is a narrow band that stays flat whether the backend is idle or saturated.

Caveats

• Agent versus plain chat. The LibreChat path runs through an agent; if your users chat with plain endpoints, the probe overstates their overhead.
• Reasoning models may stream thinking before answer content, inflating content-only TTFT. Probe with a non-reasoning model.
• Streaming switch. Open WebUI’s admin Stream Chat Response setting overrides the request’s stream flag; with it off, you’re timing full completions.
• Cardinality. Keep http.route templated; never add user, chat or file IDs as labels.
• Probe cost. Each probe is a real generation. With LibreChat balances on and a paid API behind it, the probe account burns credits, so give it its own budget.

FAQ

can open webui and librechat use the same ollama server

Yes. One Ollama instance can serve both front ends at once over its HTTP API. Open WebUI connects through OLLAMA_BASE_URL; LibreChat declares Ollama as a custom endpoint in librechat.yaml. From inside Docker, neither reaches a host-side Ollama at localhost, a trap covered in the Ollama connection guide. Models loaded by both compete for VRAM.

does open webui have a 50 user limit

No. The 50-user figure in Open WebUI’s license is a branding threshold, not a usage cap. Any number of users can run it. Above 50 users in a 30-day window you may not alter or remove Open WebUI branding unless an exception, such as an enterprise license, applies. Code up to v0.6.5 remains BSD-3 with no branding terms.

is librechat still open source after the clickhouse acquisition

Yes. ClickHouse’s announcement of November 4, 2025 states that LibreChat “remains 100% open-source” under the MIT license and that nothing changes for existing deployments. The one service change was the paid, hosted Code Interpreter API, which ClickHouse said would be discontinued in its current form, with May 1, 2026 as the target date.

can librechat run without sending data to openai

Yes, with configuration. Point chat at local models through custom endpoints, and set the RAG API’s EMBEDDINGS_PROVIDER to ollama with OLLAMA_BASE_URL, because it defaults to openai. Features such as web search and image generation call their own configured providers, so audit every enabled feature before calling a deployment offline.