Hi all, We want to be able to trigger a Flyte launchplan/workflow from a backend server that we control, with no user interaction. Ie - new data comes in to our system, we want to run a bunch of models on it automatically. How would authentication work in this case? We are using the flyte-binary helm chart, which uses the internal authorization server as far as I know. We also configured an external IdP for flyteadmin for actual human users. Any ideas?

So we do this w/ java backend services. Both our backend services and flyte are using external IdP, so we were able to take a token from one and use it to call the other. Is that an option for you?

Thanks Blake, so you mean that you have an end-user which creates a token in the IdP while working with your Java service, so you "proxy" this token to flyte?

For our specific use case, our app uses client credentials grant to mint an AT. The AT has all the required flyte scopes built in in order to call flyte. We then call flyte admin gRPC api w/ that token and can invoke flyte executions that way.

OK, so the Java app authenticates with the IdP using a long-lived api key, and gets a short-lived token for flyte?

yep

Thanks Blake, I appreciate it 🙏