MLflow Secrets Auth

A secure MLflow plugin that automatically injects authentication headers from secret management systems into tracking requests.

Features

• Zero Code Changes: Works transparently with existing MLflow applications
• Multiple Providers: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault
• Security First: Host allowlisting, credential redaction, in-memory caching only
• Production Ready: Automatic retries, TTL-based caching, comprehensive logging

Quick Start

# Install with your preferred provider
pip install mlflow-secrets-auth[vault]

# Configure for HashiCorp Vault
export VAULT_ADDR="https://vault.company.com"
export VAULT_TOKEN="your-vault-token"
export MLFLOW_VAULT_SECRET_PATH="secret/mlflow/auth"
export MLFLOW_SECRETS_AUTH_ENABLE="vault"

# Activate the plugin in MLflow (required)
export MLFLOW_TRACKING_AUTH="mlflow_secrets_auth"

# Your MLflow code works unchanged
import mlflow
mlflow.set_tracking_uri("https://mlflow.company.com")
mlflow.start_run()  # Authentication happens automatically

Demo

Try the complete working example with Vault + MLflow + Nginx:

git clone https://github.com/hugodscarvalho/mlflow-secrets-auth
cd mlflow-secrets-auth/examples/vault-nginx-mlflow
make demo

This demo shows the plugin working end-to-end with a real MLflow server protected by authentication.

Supported Providers

Documentation

• Getting Started - Quick setup guide
• Configuration - Complete configuration reference
• Providers - Provider-specific setup
• Troubleshooting - Common issues and solutions

Requirements

• Python 3.9+
• MLflow 2.20.4+
• Provider-specific SDKs (installed with extras)

License

Apache License 2.0 - see LICENSE file for details.