Prefect Open Source (OSS) version 3 does not have built-in authentication mechanisms. This is explicitly stated to be the responsibility of the user to implement if they are self-hosting. Authentication features are robustly provided only in Prefect Cloud, particularly in the Enterprise plans which offer single sign-on (SSO) integration.
For self-hosted Prefect OSS, users typically need to manage their own authentication and authorization mechanisms, as the Prefect team presumes users will either use Prefect Cloud, which has these features, or implement them independently.
Here are some relevant excerpts from
Prefect 3 documentation:
- "Prefect Cloud’s Enterprise plans offer single sign-on (SSO) integration with your team’s identity provider."
- "The Prefect Server API in the open source Prefect library is provided without auth. Prefect’s expectation is that users will either subscribe to Prefect Cloud or self-host and implement their own auth mechanism."
Additionally, there are
GitHub discussions that emphasize the lack of built-in authentication for self-hosted Prefect OSS.