Principle:Bentoml BentoML Cloud Authentication

Overview

Cloud Authentication is the principle of establishing a secure, authenticated session with the BentoCloud managed inference platform using API token-based credentials.

Concept

Authenticating with BentoCloud requires an API token that proves the caller's identity and authorization level. This token-based approach follows standard cloud platform security patterns, where a long-lived API token is issued through the BentoCloud console and used programmatically to authorize CLI and SDK operations.

Theory

API token-based authentication establishes a secure session with BentoCloud. The token is stored in a local config file and used for all subsequent cloud API calls. This design provides several advantages:

• Stateless authentication - Each request carries the token, removing the need for server-side session management
• Environment separation - Supports multiple contexts for switching between environments (staging, production) without re-authenticating
• Credential persistence - The token is saved locally so repeated logins are unnecessary
• Environment variable override - The BENTO_CLOUD_API_KEY environment variable allows token injection in CI/CD pipelines without storing credentials on disk

The authentication flow works as follows:

1. The user obtains an API token from the BentoCloud web console
2. The user runs the login command with the endpoint URL and token
3. The CLI validates the token against the BentoCloud API
4. On success, a CloudClientContext is created and persisted to a local YAML config file
5. All subsequent API calls use this stored context to authenticate requests

Multiple Contexts

BentoCloud supports named contexts, allowing users to maintain credentials for multiple environments simultaneously. Each context stores:

• Endpoint - The BentoCloud instance URL
• API Token - The authentication credential for that environment
• Context name - A human-readable identifier (e.g., "production", "staging")

Users can switch between contexts without re-entering credentials, enabling workflows that span multiple BentoCloud environments.

Security Considerations

• Tokens should be treated as secrets and never committed to version control
• The local config file should have restricted file permissions
• For CI/CD environments, prefer the BENTO_CLOUD_API_KEY environment variable over file-based storage
• Tokens can be revoked through the BentoCloud console if compromised

Metadata

Property	Value
Principle	Cloud Authentication
Domain	ML_Serving, Cloud_Deployment
Workflow	BentoCloud_Deployment
Related Concepts	API Token Management, OAuth, Cloud Security
Implementation	Implementation:Bentoml_BentoML_Cloud_Login

Knowledge Sources

• BentoML
• BentoML Docs