Hi team, a Prefect mystery (at least for me 😬) — I’m using Prefect Cloud and Prefect Core 0.11.4, also Fargate Agent and docker storage. My goal is to call the Prefect API from a state handler, so I can report flow stats to Slack like flow duration when a flow finishes. Problem is I am getting an unauthenticated error. I can see from

agent.py

that the container env should include the env var:

"PREFECT__CLOUD__AUTH_TOKEN": config.cloud.agent.auth_token,

So at this point I’m not sure if that value is not set, or it is set correctly but the agent token doesn’t have the correct auth. PS — I am open to doing this another way, such as a dedicated SlackTask, but the state handler seems somehow more semantically correct, and the CloudHook doesn’t seem to provide that kind of detailed info. (Sorry for the long post.) Thanks! 🙏

Hi Jeff! Could you share your state handler code? Specifically how you are making the API request? The env var must be working because your state updates from your Flow are making it to Cloud, so it’s hopefully just a minor tweak

Thanks Chris. The following code is getting called from the state handler:

api_token = os.getenv('PREFECT__CLOUD__AUTH_TOKEN')

_prefect_client = Client(api_token=api_token)

_prefect_client.login_to_tenant(tenant_slug="jellyfish")

There’s more code, of course, but I think this is the relevant stuff. LMK if there’s something else of interest.

ah ha! so this might seem counterintuitive but could you try

_prefect_client = Client()

and don’t call the

login_to_tenant

route at all; let me know if that works, and if it does, I’ll explain what’s happening

Yes, I will try that and report back. Thanks!

Awesome! Purely for reference: -

login_to_tenant

is a route that is only supported for Personal Access tokens (these are tokens that identify you as a user, but do not identify the tenant that you want to work within) - RUNNER tokens (which are the ones present in your environment anytime an agent submits your flow run) already have a tenant associated with them, but no user (they’re kind of like “service account” tokens) - because the

Client

infers auth info from the environment, and because agents ensure your environment is Cloud-compatible, instantiating a Client within a Flow will “do the right thing” and begin using the RUNNER token

Yes, that totally makes sense. Thanks for the help and extra info!