Open WebUI Integration¶

Connect Open WebUI to stdapi.ai as an OpenAI-compatible backend. Access Amazon Bedrock models through Open WebUI's chat interface—it works out of the box as a private ChatGPT alternative running on your AWS infrastructure.

About Open WebUI¶

🔗 Links: Website | GitHub | Documentation

Open WebUI is the leading open-source ChatGPT alternative. It provides a feature-rich, self-hosted web interface that operates entirely under your control, offering a ChatGPT-like experience while maintaining complete data privacy.

Key Features:

• ⭐ 140,000+ GitHub stars - Most popular open-source AI chat interface
• ChatGPT-like UI - Familiar interface your team already knows
• Multi-modal capabilities - Text, voice, images, and document processing
• RAG & embeddings - Upload documents, search with semantic understanding
• Extensible platform - Plugins, custom functions, and community tools
• Complete privacy - Self-hosted, all data stays in your infrastructure

Why Open WebUI + stdapi.ai?¶

%%{init: {'flowchart': {'htmlLabels': true}} }%%
flowchart LR
  openwebui["<img src='../styles/logo_openwebui.svg' style='height:64px;width:auto;vertical-align:middle;' /> Open WebUI"] --> stdapi["<img src='../styles/logo.svg' style='height:64px;width:auto;vertical-align:middle;' /> stdapi.ai"]
  stdapi --> bedrock["<img src='../styles/logo_amazon_bedrock.svg' style='height:64px;width:auto;vertical-align:middle;' /> Amazon Bedrock"]
  stdapi --> transcribe["<img src='../styles/logo_amazon_transcribe.svg' style='height:64px;width:auto;vertical-align:middle;' /> Amazon Transcribe"]
  stdapi --> polly["<img src='../styles/logo_amazon_polly.svg' style='height:64px;width:auto;vertical-align:middle;' /> Amazon Polly"]

Connect Your Own Instance¶

Point any running Open WebUI instance—wherever you host it—at your stdapi.ai gateway. Nothing below requires the AWS sample in Part 2.

Prerequisites¶

Configuration¶

Open WebUI is configured entirely through environment variables. The sections below focus on the stdapi.ai integration. Use the same stdapi.ai key for all *_OPENAI_API_KEY entries. For more details on Open WebUI settings, refer to the official Open WebUI Environment Variable Configuration documentation.

Core Connection¶

Enables: Chat completions and Open WebUI background tasks (titles, summarization).

OPENAI_API_BASE_URL=https://YOUR_STDAPI_URL/v1
OPENAI_API_KEY=YOUR_STDAPI_KEY
TASK_MODEL_EXTERNAL=amazon.nova-micro-v1:0

Use a fast, low-cost chat model for TASK_MODEL_EXTERNAL. Open WebUI calls POST /v1/chat/completions for chat and background tasks (see Chat Completions API).

RAG Embeddings¶

Enables: Document ingestion and semantic search for RAG.

RAG_EMBEDDING_ENGINE=openai
RAG_OPENAI_API_BASE_URL=https://YOUR_STDAPI_URL/v1
RAG_OPENAI_API_KEY=YOUR_STDAPI_KEY
RAG_EMBEDDING_MODEL=cohere.embed-v4:0

Open WebUI calls POST /v1/embeddings (see Embeddings API).

RAG Reranking¶

Enables: Hybrid search, with retrieved documents reordered by relevance before they reach the model.

ENABLE_RAG_HYBRID_SEARCH=true
RAG_RERANKING_ENGINE=external
RAG_EXTERNAL_RERANKER_URL=https://YOUR_STDAPI_URL/cohere/v2/rerank
RAG_EXTERNAL_RERANKER_API_KEY=YOUR_STDAPI_KEY
RAG_RERANKING_MODEL=cohere.rerank-v3-5:0

Open WebUI's external reranker speaks the Cohere dialect, so it targets the Cohere-compatible route instead of /v1 (see Cohere Rerank API). Give the full endpoint path: Open WebUI sends the request to the URL as-is and appends nothing.

Without an external reranker, Open WebUI falls back to a local Sentence-Transformers cross-encoder that it downloads from Hugging Face at startup—unavailable when OFFLINE_MODE is enabled.

Image Generation¶

Enables: Text-to-image creation inside chats.

ENABLE_IMAGE_GENERATION=true
IMAGE_GENERATION_ENGINE=openai
IMAGES_OPENAI_API_BASE_URL=https://YOUR_STDAPI_URL/v1
IMAGES_OPENAI_API_KEY=YOUR_STDAPI_KEY
IMAGE_GENERATION_MODEL=stability.stable-image-core-v1:1

Open WebUI calls POST /v1/images/generations (see Images Generations API).

Image Editing¶

Use Open WebUI's image editor to upload an image and describe the change. Masking is not configured.

Enables: Image edits and transformations in the editor.

ENABLE_IMAGE_EDIT=true
IMAGE_EDIT_ENGINE=openai
IMAGES_EDIT_OPENAI_API_BASE_URL=https://YOUR_STDAPI_URL/v1
IMAGES_EDIT_OPENAI_API_KEY=YOUR_STDAPI_KEY
IMAGE_EDIT_MODEL=stability.stable-image-control-structure-v1:0

Pick any image-editing model that supports edits without a mask. Open WebUI calls POST /v1/images/edits (see Images Edits API).

Speech to Text (STT)¶

Enables: Voice input and audio transcription.

AUDIO_STT_ENGINE=openai
AUDIO_STT_OPENAI_API_BASE_URL=https://YOUR_STDAPI_URL/v1
AUDIO_STT_OPENAI_API_KEY=YOUR_STDAPI_KEY
AUDIO_STT_MODEL=amazon.transcribe

Open WebUI calls POST /v1/audio/transcriptions (see Audio Transcriptions API).

Text to Speech (TTS)¶

Enables: Spoken responses from chat outputs.

AUDIO_TTS_ENGINE=openai
AUDIO_TTS_OPENAI_API_BASE_URL=https://YOUR_STDAPI_URL/v1
AUDIO_TTS_OPENAI_API_KEY=YOUR_STDAPI_KEY
AUDIO_TTS_MODEL=amazon.polly-neural

Open WebUI calls POST /v1/audio/speech (see Audio Speech API).

MCP Tool Server¶

Enables: Chat models calling stdapi.ai endpoints as tools, including the ones Open WebUI has no native feature for—such as video generation.

Open WebUI supports MCP servers over Streamable HTTP (v0.6.31 and later), the transport stdapi.ai exposes at /mcp. Turn it on with the stdapi.ai environment variables:

ENABLE_MCP_STREAMABLE_HTTP=true
MCP_INCLUDE_TOOLS=openai_video_generation,openai_video_get,search_models

Every endpoint is exposed as a tool by default. Restrict the list with MCP_INCLUDE_TOOLS so models see only the tools they need, and keep the ones already wired natively—chat, images, speech, embeddings—out of it.

Then register the server in Open WebUI. MCP connections are admin-only and configured in the interface, not through environment variables:

1. Open Admin Settings → External Tools
2. Click + (Add Server) and set Type to MCP (Streamable HTTP)
3. Set the server URL to https://YOUR_STDAPI_URL/mcp
4. Set Auth to Bearer and paste your stdapi.ai API key
5. Save, then enable the tool in a chat with + → Integrations → Tools

See MCP tools for the full tool list.

Known Issues¶

Deploy the Full Stack on AWS¶

The Terraform sample below is one worked example of a credible AWS deployment, not the only architecture that works. stdapi.ai's gateway is a normal HTTP service, and Open WebUI can run wherever you already operate it—your own ECS, EKS, EC2, another cloud, or a laptop.

Architecture¶

The diagram below is the topology the sample builds: a browser-facing chat application and its AI gateway, both on ECS Fargate, in one VPC you own.

%%{init: {'flowchart': {'htmlLabels': true, 'nodeSpacing': 20, 'rankSpacing': 40, 'subGraphTitleMargin': {'top': 8, 'bottom': 10}}} }%%
flowchart TB
  user["👤 Your users<br/>(browser)"]

  subgraph public["Your VPC · public subnets"]
    alb["<img src='../styles/logo_amazon_load_balancing.svg' style='height:40px;width:auto;vertical-align:middle;' /> Application Load Balancer<br/>HTTPS · ACM certificate"]
  end

  subgraph private["Your VPC · private app subnets — no inbound route from the internet"]
    openwebui["<img src='../styles/logo_openwebui.svg' style='height:40px;width:auto;vertical-align:middle;' /> Open WebUI<br/>ECS Fargate"]
    stdapi["<img src='../styles/logo.svg' style='height:40px;width:auto;vertical-align:middle;' /> stdapi.ai<br/>ECS Fargate"]
    tools["<img src='../styles/logo_searxng.svg' style='height:40px;width:auto;vertical-align:middle;' /> <img src='../styles/logo_playwright.svg' style='height:40px;width:auto;vertical-align:middle;' /><br/>SearXNG · Playwright<br/>ECS Fargate"]
    aurora["<img src='../styles/logo_amazon_aurora.svg' style='height:40px;width:auto;vertical-align:middle;' /> Aurora PostgreSQL<br/>Serverless v2 + pgvector"]
    valkey["<img src='../styles/logo_amazon_elasticache.svg' style='height:40px;width:auto;vertical-align:middle;' /> ElastiCache Valkey<br/>TLS + auth token"]
    egress["<img src='../styles/logo_amazon_vpc.svg' style='height:40px;width:auto;vertical-align:middle;' /> NAT gateways · one per AZ<br/>+ free S3 gateway endpoint"]
    aurora ~~~ tools
  end

  subgraph regional["AWS service endpoints · your account, the regions you configure"]
    bedrock["<img src='../styles/logo_amazon_bedrock.svg' style='height:40px;width:auto;vertical-align:middle;' /> Amazon Bedrock"]
    polly["<img src='../styles/logo_amazon_polly.svg' style='height:40px;width:auto;vertical-align:middle;' /> Amazon Polly"]
    transcribe["<img src='../styles/logo_amazon_transcribe.svg' style='height:40px;width:auto;vertical-align:middle;' /> Amazon Transcribe"]
    s3["<img src='../styles/logo_amazon_s3.svg' style='height:40px;width:auto;vertical-align:middle;' /> Amazon S3<br/>SSE-KMS"]
    cw["<img src='../styles/logo_amazon_cloudwatch.svg' style='height:40px;width:auto;vertical-align:middle;' /> Amazon CloudWatch<br/>logs · metrics · alarms"]
    bedrock ~~~ transcribe ~~~ cw
    polly ~~~ s3
  end

  user -->|"HTTPS · TLS 1.2+<br/>(HTTP until a domain is set)"| alb
  alb -->|"HTTP · private subnet"| openwebui
  openwebui -->|"OpenAI + Cohere API · API key<br/>private DNS, no public endpoint"| stdapi
  openwebui --> aurora
  openwebui --> valkey
  openwebui --> tools
  openwebui --> egress
  stdapi --> egress
  egress -->|"HTTPS · SigV4"| bedrock
  egress -->|"HTTPS · SigV4"| polly
  egress -->|"HTTPS · SigV4"| transcribe
  egress -->|"S3 gateway endpoint"| s3
  egress --> cw

Two properties of this topology are worth reading off the picture. The gateway has no listener of its own: Open WebUI resolves it through AWS Cloud Map private DNS inside the VPC, so the load balancer is the only thing with a public address, and it only ever forwards to Open WebUI. And every store that holds your users' content — the Aurora database, the Valkey cache, the S3 bucket — sits inside the account boundary; nothing in the picture is operated by a third party.

What Each AWS Service Does Here¶

Security Measures in This Flow¶

• Authentication — Open WebUI signs in its own users; every call it then makes to the gateway carries a stdapi.ai API key that Terraform generates and injects into the container environment.
• Encryption in transit — HTTPS from the browser to the ALB, whose listener supports TLS 1.2 and 1.3; private-VPC traffic from the ALB to the container; HTTPS with SigV4 from the gateway to each AWS service.
• Encryption at rest — SSE-KMS on the S3 bucket, encrypted Aurora storage, and TLS plus an auth token on the Valkey connection.
• Least privilege — each ECS task assumes its own role; the gateway's role carries no permission for the Aurora cluster, and Open WebUI's role carries none for Amazon Bedrock.
• Content policy — a Bedrock guardrail configured on the gateway applies to each route Open WebUI uses, not only to chat, and stays in force unless the deployment explicitly allows a per-request override.
• Data handling — the gateway is stateless and holds request bodies in memory only; CloudWatch receives request metadata, not prompts, unless payload logging is explicitly turned on for debugging.

What's Included¶

Deploy Open WebUI + stdapi.ai together with production infrastructure:

📦 stdapi-ai/samples/getting_started_openwebui

What's included:

• Open WebUI on ECS Fargate with auto-scaling
• stdapi.ai gateway connected to Amazon Bedrock
• ElastiCache Valkey for caching
• Aurora PostgreSQL with pgvector extension for RAG, with hybrid search and reranking
• SearXNG for web search integration
• Playwright for web scraping
• HTTPS with ALB on your own domain
• All environment variables pre-configured
• Official container images used as published — no local Docker build and no registry credential

Deploy:

git clone https://github.com/stdapi-ai/samples.git
cd samples/getting_started_openwebui/terraform
tofu init
tofu apply

What It Costs to Run¶

Read a model's price before you send anything to it with GET /model_pricing. Setting COST_TRACKING=true additionally puts a per-request cost on each usage entry — estimated from published AWS prices, not read back from your invoice.

What to Watch¶

Both containers log to CloudWatch: Open WebUI writes its audit trail to stdout (ENABLE_AUDIT_STDOUT=true), and the gateway writes one structured request event per call carrying the request id, path, status code, execution_time_ms, the model that served it, and the token counts AWS billed. Turning on CLOUDWATCH_METRICS republishes those counts as CloudWatch metrics in the stdapi namespace, dimensioned by Model, so a dashboard can plot chat, embedding, image and speech consumption side by side.

For a chat deployment the useful first question is which feature is consuming the models — the Core Connection, RAG, images or voice all arrive on different paths:

fields path, execution_time_ms
| filter type = "request"
| stats count(*) as calls, pct(execution_time_ms, 95) as p95_ms by path
| sort calls desc

Amazon Bedrock model invocation logging is the AWS-side counterpart — off by default, and the record to enable when you need the prompts and completions themselves rather than metadata.

Next Steps¶