Install the auth extras, set the Flask secret key and an admin password as environment variables, and start the server with the app name basic-auth. MLflow's documentation says the server refuses to start without an admin password, because it ships no default one.
Why the tracking server needs it
An experiment tracker holds parameters, metrics, artifacts and registered models. It is also where people paste things they should not, such as connection strings. A server on a shared network with no login lets anyone who can reach it read and change all of that. MLflow adds HTTP basic authentication to the tracking server to provide access control over experiments, registered models and scorers.
Steps from the documentation
- Install the extras:
pip install 'mlflow[auth]'. - Set the CSRF secret key in
MLFLOW_FLASK_SERVER_SECRET_KEY, and keep it identical across servers. - Set the admin password in
MLFLOW_AUTH_ADMIN_PASSWORD. - Launch it:
mlflow server --app-name basic-auth
To turn auth off, restart without the app name. The docs say users and permissions persist for when you enable it again.
Admin password details
The docs state that MLflow ships no default admin password and refuses to start if neither the environment variable nor the config file value is set. Passwords must be at least 12 characters. An older default value is no longer accepted, tied to an advisory the page references, and administrators who still had it must set a new password and restart once. After the first successful start, the page advises unsetting the admin password variable and rotating the password through the update password endpoint.
Permission levels
| Level | Can do |
|---|---|
| READ | Read only |
| USE | Read and use |
| EDIT | Read, use and update |
| MANAGE | Read, use, update, delete and manage others' access |
| NO_PERMISSIONS | No access |
Each user's default permission is READ, which you can change in the configuration. The page says permissions are granted through roles from MLflow 3.13.0, and unauthorized requests get a 403. Admins have full access even if NO_PERMISSIONS is set on their account.
What basic auth does not do
It is a login and a permission model, not network protection. Keep the server off the public internet, serve it over TLS, and store the user database somewhere backed up. Basic authentication sends credentials with each request, so encryption in transit matters. Give service accounts for training jobs the lowest level they need, usually USE or EDIT on one experiment, rather than MANAGE.
A short audit
- Is the server reachable from outside your network?
- Is authentication on, and is the admin password stored in a secret manager?
- Who has MANAGE?
- Do old runs hold secrets in parameters or tags? See what not to log in experiment tracking.
Safeguard's asset discovery can help you find tracking servers you forgot about, and the free scan is at gold.safeguard.sh/scan.
Quick check
Is there a default admin password?
Per the docs, no. The server will not start without one set.
What is the default user permission?
READ, which can be changed in configuration.
Sources
Last reviewed: 19 October 2026.
