[TypeScript SDK] Simplify Databricks auth by delegating to Databricks SDK by simonfaltum · Pull Request #19434 · mlflow/mlflow

simonfaltum · 2025-12-16T14:51:38Z

What changes are proposed in this pull request?

This PR adds a new authentication module to the MLflow TypeScript SDK that provides flexible authentication for both self-hosted MLflow servers and managed MLflow services.

Key Changes:

New auth module (libs/typescript/core/src/auth/index.ts)
- Provides AuthProvider interface with sync getHost() and async getHeadersProvider()
- Supports basic auth (username/password) and bearer token authentication
- Clean separation of authentication concerns from client code
Updated artifacts clients
- Both DatabricksArtifactsClient and MlflowArtifactsClient now use AuthProvider pattern
- Legacy databricksToken parameter kept for backwards compatibility
Documentation
- Added authentication section to README for self-hosted MLflow servers

This change is fully backwards compatible.

How is this PR tested?

Existing unit/integration tests
New unit/integration tests
Manual tests

All 172 tests pass, including new tests for authentication configuration.

Does this PR require documentation update?

Updated libs/typescript/README.md with authentication documentation for self-hosted MLflow servers.

Release Notes

Is this a user-facing change?

No. You can skip the rest of this section.
Yes. Give a description of this change to be included in the release notes for MLflow users.

The TypeScript SDK now has a dedicated authentication module supporting basic auth and bearer token authentication for MLflow tracking servers.

What component(s), interfaces, languages, and integrations does this PR affect?

Components

How should the PR be classified in the release notes? Choose one:

rn/none - No description will be included. The PR will be mentioned only by the PR number in the "Small Bugfixes and Documentation Updates" section
rn/breaking-change - The PR will be mentioned in the "Breaking Changes" section
rn/feature - A new user-facing feature worth mentioning in the release notes
rn/bug-fix - A user-facing bug fix worth mentioning in the release notes
rn/documentation - A user-facing documentation change worth mentioning in the release notes

Should this PR be included in the next patch release?

Yes (this PR will be cherry-picked and included in the next patch release)
No (this PR will be included in the next minor release)

github-actions · 2025-12-16T14:51:51Z

@simonfaltum Thank you for the contribution! Could you fix the following issue(s)?

⚠ DCO check

The DCO check failed. Please sign off your commit(s) by following the instructions here. See https://github.com/mlflow/mlflow/blob/master/CONTRIBUTING.md#sign-your-work for more details.

⚠ Invalid PR template

This PR does not appear to have been filed using the MLflow PR template. Please copy the PR template from here and fill it out.

… SDK - Add new auth module that delegates credential resolution to @databricks/sdk - Require DATABRICKS_HOST env var for Databricks connections (enables sync host resolution) - SDK handles PAT tokens, OAuth M2M, Azure/GCP credentials, and config profiles - Support OSS MLflow auth via basic auth or bearer token - Update artifacts clients to use AuthProvider pattern - Add authentication documentation to README 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> Signed-off-by: simon <simon.faltum@databricks.com>

libs/typescript/core/src/auth/index.ts

libs/typescript/core/src/clients/artifacts/databricks.ts

libs/typescript/core/src/clients/client.ts

MlflowClient and ArtifactsClient are internal APIs, so this removes backwards-compatibility options that are no longer needed: - Remove deprecated host, databricksToken, and tracking server credentials from MlflowClientOptions and ArtifactsClientOptions - Make authProvider a required parameter - Remove unused getRequestHeaders helper from utils.ts - Move base64 auth header encoding outside function scope for efficiency - Update provider.ts to use getAuthProvider() from config - Remove deprecated resolveAuthProvider alias This reduces code duplication by centralizing auth handling in the createAuthProvider function, which consumers should use to create an AuthProvider before passing it to these clients. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> Signed-off-by: simon <simon.faltum@databricks.com>

TomeHirata · 2025-12-17T15:22:17Z

libs/typescript/core/src/clients/artifacts/index.ts

-  host: string;
-  databricksToken?: string;
-}): ArtifactsClient {
+export function getArtifactsClient(options: ArtifactsClientOptions): ArtifactsClient {


Let's keep using destructuring assignment. We can use destructuring assignment and interface together.

TomeHirata · 2025-12-17T15:23:32Z

libs/typescript/core/src/clients/artifacts/mlflow.ts

+  private headersProvider: HeadersProvider;

-  constructor(options: { host: string }) {
+  constructor(options: MlflowArtifactsClientOptions) {


TomeHirata · 2025-12-17T15:25:39Z

libs/typescript/core/src/clients/client.ts

+   *
+   * @param options - Client configuration options
+   */
+  constructor(options: MlflowClientOptions) {


TomeHirata · 2025-12-17T15:42:55Z

libs/typescript/core/src/auth/index.ts

+    const result: Record<string, string> = {};
+    headers.forEach((value, key) => {
+      result[key] = value;
+    });
+    return result;


Can we use Object.fromEntries(headers)?

TomeHirata

Left some comments, otherwise LGTM!

daniellok-db · 2025-12-18T00:13:15Z

libs/typescript/core/src/clients/client.ts

+    const headers = await this.headersProvider();
+    const response = await makeRequest<CreateExperiment.Response>('POST', url, headers, payload);


nit: i wonder if it's worth defining some request helper on the class so we don't have to remember to call const headers = await this.headersProvider(); and pass it in to every request

not a big deal for now as i guess we don't plan to add many more request types but just thinking for the future

Great idea, I think we can replace headers with headersProvider in makeRequest to prevent such mistakes.

daniellok-db

lg overall, thanks for making this change!

Signed-off-by: B-Step62 <yuki.watanabe@databricks.com>

simonfaltum force-pushed the simonfaltum/js-lib-dbx-auth branch 2 times, most recently from 0280d74 to ef3a52a Compare December 16, 2025 15:20

github-actions bot added area/docs Documentation issues area/tracing MLflow Tracing and its integrations area/tracking Tracking service, tracking client APIs, autologging rn/feature Mention under Features in Changelogs. labels Dec 16, 2025

simonfaltum force-pushed the simonfaltum/js-lib-dbx-auth branch from ef3a52a to da8c3cb Compare December 16, 2025 15:32

B-Step62 reviewed Dec 17, 2025

View reviewed changes

B-Step62 requested review from TomeHirata and daniellok-db December 17, 2025 04:47

github-actions bot assigned B-Step62 Dec 17, 2025

simonfaltum mentioned this pull request Dec 17, 2025

[TypeScript SDK] Add pluggable authentication provider system #19166

Closed

10 tasks

simonfaltum requested a review from B-Step62 December 17, 2025 10:42

TomeHirata reviewed Dec 17, 2025

View reviewed changes

TomeHirata approved these changes Dec 17, 2025

View reviewed changes

github-actions bot assigned TomeHirata Dec 17, 2025

daniellok-db reviewed Dec 18, 2025

View reviewed changes

daniellok-db approved these changes Dec 18, 2025

View reviewed changes

github-actions bot assigned daniellok-db Dec 18, 2025

B-Step62 approved these changes Dec 18, 2025

View reviewed changes

B-Step62 linked an issue Dec 19, 2025 that may be closed by this pull request

[FR] Support Databricks config file with Client ID and Client Secret #18477

Closed

14 tasks

B-Step62 added 3 commits December 22, 2025 10:55

comments

137fd51

Signed-off-by: B-Step62 <yuki.watanabe@databricks.com>

lint

5d5e012

Signed-off-by: B-Step62 <yuki.watanabe@databricks.com>

fmt

a5d9868

Signed-off-by: B-Step62 <yuki.watanabe@databricks.com>

integ

587022b

Signed-off-by: B-Step62 <yuki.watanabe@databricks.com>

B-Step62 added this pull request to the merge queue Dec 22, 2025

Merged via the queue into mlflow:master with commit 1caf293 Dec 22, 2025
42 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[TypeScript SDK] Simplify Databricks auth by delegating to Databricks SDK#19434

[TypeScript SDK] Simplify Databricks auth by delegating to Databricks SDK#19434
B-Step62 merged 6 commits intomlflow:masterfrom
simonfaltum:simonfaltum/js-lib-dbx-auth

simonfaltum commented Dec 16, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Dec 16, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TomeHirata Dec 17, 2025 •

edited

Loading

Uh oh!

TomeHirata Dec 17, 2025

Uh oh!

TomeHirata Dec 17, 2025

Uh oh!

TomeHirata Dec 17, 2025

Uh oh!

TomeHirata left a comment •

edited

Loading

Uh oh!

daniellok-db Dec 18, 2025

Uh oh!

daniellok-db Dec 18, 2025

Uh oh!

B-Step62 Dec 22, 2025 •

edited

Loading

Uh oh!

daniellok-db left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		const headers = await this.headersProvider();
		const response = await makeRequest<CreateExperiment.Response>('POST', url, headers, payload);

Conversation

simonfaltum commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changes are proposed in this pull request?

How is this PR tested?

Does this PR require documentation update?

Release Notes

Is this a user-facing change?

What component(s), interfaces, languages, and integrations does this PR affect?

How should the PR be classified in the release notes? Choose one:

Should this PR be included in the next patch release?

Uh oh!

github-actions bot commented Dec 16, 2025

⚠ DCO check

⚠ Invalid PR template

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TomeHirata Dec 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TomeHirata Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

TomeHirata Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

TomeHirata Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

TomeHirata left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

daniellok-db Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

daniellok-db Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

B-Step62 Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

daniellok-db left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

simonfaltum commented Dec 16, 2025 •

edited

Loading

TomeHirata Dec 17, 2025 •

edited

Loading

TomeHirata left a comment •

edited

Loading

B-Step62 Dec 22, 2025 •

edited

Loading