Hi team, a Prefect mystery (at least for me :grima...
# prefect-community
Hi team, a Prefect mystery (at least for me 😬) — I’m using Prefect Cloud and Prefect Core 0.11.4, also Fargate Agent and docker storage. My goal is to call the Prefect API from a state handler, so I can report flow stats to Slack like flow duration when a flow finishes. Problem is I am getting an unauthenticated error. I can see from
that the container env should include the env var:
"PREFECT__CLOUD__AUTH_TOKEN": config.cloud.agent.auth_token,
So at this point I’m not sure if that value is not set, or it is set correctly but the agent token doesn’t have the correct auth. PS — I am open to doing this another way, such as a dedicated SlackTask, but the state handler seems somehow more semantically correct, and the CloudHook doesn’t seem to provide that kind of detailed info. (Sorry for the long post.) Thanks! 🙏
Here’s the error I see:
AuthorizationError([{'path': ['switch_tenant'], 'message': 'Unauthenticated', 'extensions': {'code': 'UNAUTHENTICATED'}}])
Hi Jeff! Could you share your state handler code? Specifically how you are making the API request? The env var must be working because your state updates from your Flow are making it to Cloud, so it’s hopefully just a minor tweak
Thanks Chris. The following code is getting called from the state handler:
api_token = os.getenv('PREFECT__CLOUD__AUTH_TOKEN')
_prefect_client = Client(api_token=api_token)
There’s more code, of course, but I think this is the relevant stuff. LMK if there’s something else of interest.
ah ha! so this might seem counterintuitive but could you try
Copy code
_prefect_client = Client()
and don’t call the
route at all; let me know if that works, and if it does, I’ll explain what’s happening
Yes, I will try that and report back. Thanks!
👍 1
Yes, that worked. Many thanks for the quick and helpful response! 🙏
Awesome! Purely for reference: -
is a route that is only supported for Personal Access tokens (these are tokens that identify you as a user, but do not identify the tenant that you want to work within) - RUNNER tokens (which are the ones present in your environment anytime an agent submits your flow run) already have a tenant associated with them, but no user (they’re kind of like “service account” tokens) - because the
infers auth info from the environment, and because agents ensure your environment is Cloud-compatible, instantiating a Client within a Flow will “do the right thing” and begin using the RUNNER token
@Marvin archive “Issue using a Prefect Client within a state handler”
Yes, that totally makes sense. Thanks for the help and extra info!