Generating Temporary Access Keys for CML API Endpoints

[#1]

Hello Cloudera Community,

I'm working on a project where I need to provide users with temporary access to call specific Cloudera Machine Learning (CML) API endpoints, particularly for interacting with deployed models.

My goal is to avoid granting users long-lived API V2 keys and instead generate short-lived, scoped access credentials that expire after a set time (e.g., 2 hours).

After exploring the CML API v2 and the cmlapi library, I'm finding it challenging to identify a direct method for generating these temporary, scoped access keys.

My questions are:

1. Is there a supported mechanism within the CML API v2 or cmlapi to generate temporary access keys with a specified expiration time?
2. If not, are there recommended alternative approaches for providing users with limited, time-bound access to CML API endpoints?
3. Are there plans to introduce temporary access key generation functionality in future CML releases?
4. Is there a best practice to follow for this kind of implementation?

I'm aiming for a solution that prioritizes security and minimizes the risk of exposing long-term credentials.

Any guidance or insights from the community would be greatly appreciated.

Thank you.

[#2]

@waelfatah Welcome to the Cloudera Community!

To help you get the best possible solution, I have tagged our CML experts @smdas @Mike @Gopinath  who may be able to assist you further.

Please keep us updated on your post, and we hope you find a satisfactory solution to your query.

[#3 · Accepted solution]

1. Is there a supported mechanism within the CML API v2 or cmlapi to generate temporary access keys with a specified expiration time?
   

Yes. You may consider using cmlv2 api createV2Key [1]. I am able to get a apikey created for myself with ttl as 5 days ie 30 Mar 2025. 

api request:

curl -X POST "https://trimmed.cloudera.site/api/v2/users/ngopinath/v2_keys" -H "accept: application/json" -H "Authorization: Bearer trimmed.trimmed" -H "Content-Type: application/json" -d "{ \"comments\": \"test\", \"expiry_date\": \"2025-03-30\", \"username\": \"ngopinath\"}"

api response:

{
  "api_key": "trimmed.trimmed",
  "key_id": "trimmed",
  "created_at": "2025-03-25",
  "expiry_date": "2025-03-30",
  "comments": "test",
  "audiences": [
    "API"
  ]
}

Since we have solution for Q#1, I presume following queries are invalidated. Let me know if you are able to proceed with api createV2Key.

[1] https://docs.cloudera.com/machine-learning/cloud/rest-api-reference-ai-workbench/index.html#api-CMLS...

[#4]

@waelfatah  is createV2Key working for you?

[#5]

Thank you for answering !

curl -X POST "https://trimmed.cloudera.site/api/v2/users/ngopinath/v2_keys" -H "accept: application/json" -H "Authorization: Bearer trimmed.trimmed" -H "Content-Type: application/json" -d "{ \"comments\": \"test\", \"expiry_date\": \"2025-03-30\", \"username\": \"ngopinath\"}"

 Is it possible to provide a username and a password instead of the bearer in the authorization header?

[#6]

@waelfatah Based on the way, CAI handles the v2 API call, I don't think cmlv2api support simple authentication. 

[#7]

@waelfatah Has the reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future.  Thanks.