Short answer: yes. In Prefect 3.x, a task worker can connect directly to Prefect Cloud via a WebSocket at

/task_runs/subscriptions/scheduled

. A 403 at that endpoint almost always means an auth/config mismatch. What to check/fix: - Use Prefect Cloud login to set the correct profile (this sets both

PREFECT_API_URL

and your API key):

prefect cloud login -k <YOUR_API_KEY> -w <account_handle>/<workspace_handle>
  prefect config view

You should see: -

PREFECT_API_URL = <https://api.prefect.cloud/api>

-

PREFECT_API_KEY = **

(redacted) - If you prefer env vars, set them explicitly before starting your worker process:

export PREFECT_API_URL="<https://api.prefect.cloud/api>"
  export PREFECT_API_KEY="<YOUR_API_KEY>"

Common pitfall: missing the “/api” suffix in

PREFECT_API_URL

. - Make sure the worker process is using the profile you configured (if you have multiple):

prefect profile ls
  prefect profile use <your-profile>

- If you are actually pointing at a self-hosted Prefect Server with basic auth, the client must use:

export PREFECT_API_URL="http://<host>:<port>"
  export PREFECT_API_AUTH_STRING="username:password"

If the server has

PREFECT_SERVER_API_AUTH_STRING

set, the client must send the matching

PREFECT_API_AUTH_STRING

or the WebSocket upgrade can fail with 401/403. - Upgrade to the latest Prefect 3.x if you’re on an older version, as there have been fixes around WebSocket auth/handshakes:

pip install -U prefect
  prefect version

Minimal working example for a task worker:

from prefect import task
from prefect.task_worker import serve

@task
def hello(name: str) -> str:
    return f"hi {name}"

if __name__ == "__main__":
    # Pick up tasks of this name from Prefect Cloud once authenticated
    serve(hello)

If you still see 403s after the above: - Confirm the API key belongs to (and has access to) the workspace you logged into. - Share your Prefect version, how you start the worker (script/command), and which auth method you’re using (Cloud API key vs. self-hosted auth string). Redact secrets, of course.