That error means the flow pod can’t authenticate to Prefect’s event stream. In Prefect 3.x this almost always comes down to missing or invalid Prefect Cloud credentials inside the Kubernetes job pod. Common causes - PREFECT_API_KEY and/or PREFECT_API_URL are not present in the flow pod’s environment - The API key is invalid/rotated/deleted - PREFECT_API_URL points to the wrong account/workspace - Network egress from the pod to Prefect Cloud is blocked (HTTPS 443) Quick checks 1) Inspect the pod’s env

kubectl -n <your-ns> exec -it <flow-pod-name> -- env | grep PREFECT_

You should see at least: - PREFECT_API_URL=https://api.prefect.cloud/api/accounts/&lt;account-id&gt;/workspaces/&lt;workspace-id> - PREFECT_API_KEY=<redacted> 2) Validate the API key and URL locally - Ensure the URL matches your workspace exactly - Test the key:

prefect config view --show-secrets
prefect cloud workspace ls

If the key is invalid or revoked, regenerate a new one in the UI and redeploy. Docs: Manage API keys • Settings and profiles 3) Ensure the k8s work pool or deployment passes creds into the pod - Add env to the work pool’s base job template (recommended), or - Add env via

job_variables

when deploying Example: reference a Kubernetes Secret from the job template - Create a secret

kubectl -n <your-ns> create secret generic prefect-api-key --from-literal=key=<YOUR_API_KEY>

- In your k8s work pool base job template (UI or API), include:

job:
  env:
    - name: PREFECT_API_URL
      value: "<https://api.prefect.cloud/api/accounts/<account-id>/workspaces/<workspace-id>>"
    - name: PREFECT_API_KEY
      valueFrom:
        secretKeyRef:
          name: prefect-api-key
          key: key

Or inject via deployment `job_variables`:

flow.from_source("<repo-or-path>", entrypoint="path/to/flow.py:flow").deploy(
  name="my-deployment",
  work_pool_name="my-k8s-pool",
  job_variables={
    "namespace": "<your-ns>",
    "env": [
      {"name": "PREFECT_API_URL", "value": "<https://api.prefect.cloud/api/accounts/<account-id>/workspaces/<workspace-id>>"},
      {
        "name": "PREFECT_API_KEY",
        "valueFrom": {"secretKeyRef": {"name": "prefect-api-key", "key": "key"}}
      }
    ]
  }
)

4) Verify network egress - From the pod, confirm outbound HTTPS works:

kubectl -n <your-ns> exec -it <flow-pod-name> -- curl -sS <https://api.prefect.cloud/api/status>

If blocked, update your egress rules to allow api.prefect.cloud:443. Docs: Troubleshoot Cloud • Kubernetes work pools • Customize job variables A few clarifying questions to pinpoint this faster: - Are you running against Prefect Cloud, and if so, did you set PREFECT_API_URL and PREFECT_API_KEY in the work pool’s base job template or in the deployment’s job_variables? - Can you share (sanitized) the output of

env | grep PREFECT_

from the failing pod? - Have you recently rotated or deleted the API key being used? - Which namespace/work pool name are you using, and does the pod have egress to the internet? If you share those details, I can suggest the exact changes to your work pool/deployment config.