MLflow:Auth

lastmod 2026-04-01created 2026-04-011 edits

Defines the JWT (JSON Web Token)-based authentication flow for API requests to the MLflow Tracking Server.

Overview

When registering models or logging experiment data to a custom MLflow Tracking Server, every API request requires JWT authentication.

The MLflow Python SDK supports Bearer Token authentication through the MLFLOW_TRACKING_TOKEN environment variable.

Authentication flow in detail

Step 1: Issuing credentials (agreed in advance)

GeoSoft issues API access credentials to ITL.

Item	Details
Issued items	`client_id`, `client_secret`
Issuer	GeoSoft (operates the MLOps platform)
Recipient	ITL (model development)
Delivery method	Delivered in advance over a secure channel
Responsibility	ITL stores the credentials securely

Step 2: Obtaining a JWT token

ITL submits the credentials to the authentication endpoint and receives a JWT.

Request

POST /auth/token HTTP/1.1
Host: <tracking-server>
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=<client_id>&client_secret=<client_secret>

Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Field	Type	Description
`access_token`	`STRING`	JWT access token
`token_type`	`STRING`	Always `Bearer`
`expires_in`	`INT`	Token validity period (seconds)

Step 3: API requests

Call the MLflow API with the obtained JWT included in the Authorization header.

POST /api/2.0/mlflow/runs/log-batch HTTP/1.1
Host: <tracking-server>
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJSUzI1NiIs...

{
  "run_id": "abc123",
  "metrics": [{"key": "accuracy", "value": 0.95, "timestamp": 1711000000000}]
}

Step 4: Token expiration and renewal

When the JWT expires, the Tracking Server returns 401 Unauthorized. ITL repeats step 2 to obtain a new token.

[토큰 유효]  API 호출 → 200 OK
[토큰 만료]  API 호출 → 401 Unauthorized → 토큰 재발급 → API 재호출

MLflow Python SDK integration

Setting environment variables

The MLflow Python SDK recognizes the following environment variables and inserts the authentication header automatically.

Environment variable	Purpose	Notes
`MLFLOW_TRACKING_URI`	Tracking Server address	`https://` required
`MLFLOW_TRACKING_TOKEN`	JWT access token	When set, `Authorization: Bearer`<token> is inserted automatically

Usage example

# 1. JWT 획득
TOKEN=$(curl -s -X POST https://<tracking-server>/auth/token \
  -d "grant_type=client_credentials&client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}" \
  | jq -r .access_token)

# 2. 환경변수 설정
export MLFLOW_TRACKING_URI=https://<tracking-server>
export MLFLOW_TRACKING_TOKEN=$TOKEN

# 3. Python SDK 사용 (인증 헤더 자동 삽입)
python train.py

import mlflow

# 환경변수가 설정되어 있으면 별도 인증 코드 불필요
mlflow.set_experiment("quality-inspection")

with mlflow.start_run():
    mlflow.log_param("model_type", "yolov8")
    mlflow.log_metric("accuracy", 0.95)
    mlflow.log_artifact("model.pth")
    # 모든 호출에 Authorization: Bearer <JWT> 헤더가 자동 포함됨

Authentication order inside the SDK

The MLflow SDK determines the authentication method in the following order of priority.

Priority	Environment variable	Resulting header
1	`MLFLOW_TRACKING_TOKEN`	`Authorization: Bearer`<token>
2	`MLFLOW_TRACKING_USERNAME` + `MLFLOW_TRACKING_PASSWORD`	`Authorization: Basic`<base64>
3	`MLFLOW_TRACKING_HEADERS` (JSON)	Arbitrary custom headers

INFORMATION
The SDK only passes the token through as is; it does not issue, renew, or handle expiration of JWTs. Since API calls fail with `401` once the token expires, long-running training pipelines must implement token renewal logic separately.

Security requirements

Item	Requirement
Transport encryption	TLS (HTTPS) required. Sending tokens over plaintext HTTP is prohibited
Credential storage	Store `client_secret` in environment variables or a secret management tool. Hardcoding it in source code is prohibited
Token validity period	Set according to operational policy (e.g. 1 hour). Avoid excessively long expiration times
Token renewal	Proactive renewal before expiration is recommended. Prevents data loss from token expiration during training
Access control	Set a permission scope per credential. Apply the principle of least privilege

Related pages

Favorite site

author Zer0 sitemap