open-webui was sending OAuth credentials via both client_secret_basic (header) and client_secret_post (body) simultaneously, which Authelia rejects. Setting OAUTH_TOKEN_ENDPOINT_AUTH_METHOD=client_secret_post forces a single method and matches the updated Authelia client config. WEBUI_SECRET_KEY is now a stable env var so watchtower image updates no longer invalidate all user sessions.