GitHub user KochankovID created a discussion: Why doesn't the client
automatically obtain and refresh JWT tokens?
I'm using apache-airflow-client >=3.3.1, <4.0.0 to interact with the Airflow 3
Public REST API.
I've noticed that Configuration exposes username and password fields, but the
client doesn't seem to use them to automatically obtain an access token via the
authentication endpoint (POST /auth/token).
This is quite confusing and makes the authentication experience unnecessarily
complicated.
**Expected behavior**
When a user configures the client with credentials:
configuration = Configuration(
host=AIRFLOW_URL,
username=USERNAME,
password=PASSWORD,
)
I would expect the client to:
Automatically request an access token from the configured authentication
endpoint.
Attach the token as Authorization: Bearer <token> to subsequent API requests.
Automatically refresh or re-acquire the token when it expires.
Retry failed requests when the failure is caused by an expired access token.
**Actual behavior**
The client doesn't automatically perform this authentication flow. Users have
to manually:
Send an HTTP request to /auth/token.
Extract the access_token from the response.
Configure the client with access_token.
Implement token expiration and refresh handling themselves.
This essentially forces every consumer to implement authentication logic
outside the official Airflow client.
**Questions**
What is the intended purpose of username and password in Configuration when
using Airflow 3?
Is automatic JWT authentication intentionally unsupported?
Why isn't JWT acquisition and lifecycle management implemented as part of the
official client?
Is there an existing recommended way to configure automatic JWT authentication
without implementing a custom authentication layer?
GitHub link: https://github.com/apache/airflow-client-python/discussions/160
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to: [email protected]
