In Prefect 3.x, set it via the Prefect Worker Helm chart’s

worker.extraEnvVars

in your values.yaml. Example values.yaml:

worker:
  # your other worker config...

  extraEnvVars:
    - name: PREFECT_API_TLS_INSECURE_SKIP_VERIFY
      value: "true"

If you prefer ConfigMaps/Secrets:

worker:
  extraEnvVarsCMs:
    - my-configmap
  extraEnvVarsSecrets:
    - my-secret

Install/update with your values:

helm repo add prefect <https://prefecthq.github.io/prefect-helm>
helm repo update
helm upgrade --install prefect-worker prefect/prefect-worker -n prefect -f values.yaml

Security note: Only use

PREFECT_API_TLS_INSECURE_SKIP_VERIFY=true

for development or when you fully understand the risk. In production with self-signed certs, consider mounting your CA and setting

PREFECT_API_SSL_CERT_FILE

instead. Links: - Prefect Helm repo: prefect-helm - Worker chart values.yaml: prefect-worker values.yaml - Kubernetes how-to guide: Kubernetes deployment guide

You add basicAuth under the worker’s self-hosted API config in your values.yaml. Here’s the exact structure:

worker:
  apiConfig: selfHostedServer
  config:
    workPool: kube-test

  selfHostedServerApiConfig:
    apiUrl: <https://prefect-server.prefect.svc.cluster.local:4200/api>
    basicAuth:
      enabled: true
      # Prefer referencing an existing Secret (takes precedence)
      existingSecret: worker-auth-secret
      # Or inline (not recommended for prod)
      # authString: "admin:password123"

Notes: - The Kubernetes Secret must contain a key named

auth-string

with the value

username:password

. - Example to create the secret:

kubectl create secret generic worker-auth-secret \
    -n prefect \
    --from-literal auth-string='admin:password123'

- If you also enable basic auth on the Prefect Server chart, configure:

server:
    basicAuth:
      enabled: true
      existingSecret: server-auth-secret

Install/update:

helm repo add prefect <https://prefecthq.github.io/prefect-helm>
helm repo update
helm upgrade --install prefect-worker prefect/prefect-worker -n prefect -f worker-values.yaml

Links: - Worker chart values.yaml: prefect-worker values.yaml - Server chart values.yaml: prefect-server values.yaml - Server Helm docs: Server Helm docs

You’ve got two easy options in Prefect 3.x: set it in your active profile with the CLI, or write it into your profile file. Option A — CLI (persists in the active profile):

prefect config set PREFECT_API_URL=<http://127.0.0.1:4200/api>
prefect config set PREFECT_API_AUTH_STRING="username:password"

- Verify:

prefect config view

- If you use multiple profiles:

prefect profile create my-selfhosted
  prefect profile use my-selfhosted
  prefect config set PREFECT_API_URL=<http://127.0.0.1:4200/api>
  prefect config set PREFECT_API_AUTH_STRING="username:password"

Option B — prefect.toml in your profile:

[api]
url = "<http://127.0.0.1:4200/api>"
auth_string = "username:password"

Notes: -

PREFECT_API_AUTH_STRING

is for basic auth to a self-hosted API. Use

PREFECT_API_KEY

instead if you’re connecting to Prefect Cloud. - You can also set environment variables directly for a single shell/session:

export PREFECT_API_URL="<http://127.0.0.1:4200/api>"
  export PREFECT_API_AUTH_STRING="username:password"

Helpful links: - Settings & Profiles concept: Settings and profiles - CLI: config commands: prefect config CLI - CLI: profiles commands: prefect profile CLI - Settings reference: Settings reference