GitHub user FrancescoCastaldi added a comment to the discussion: Does api-key PR been merged on v6.1.0 release? https://github.com/apache/superset/pull/37973
No, PR #37973 was **not** included in the Superset 6.1.0 release. ### Release Timeline and Branch Details - **PR #37973** (`feat(api-keys): add API key authentication via FAB SecurityManager`) was merged into the `master` branch on **March 24, 2026**. - The `6.1.0` release branch was cut prior to this feature stabilization and was not cherry-picked into 6.1.0 because it introduced new database models and required an upstream feature branch of Flask-AppBuilder. You can verify that this code is absent from 6.1.0 by checking the codebase: searching for `FAB_API_KEY_ENABLED` in the 6.1.0 tag returns no results in `superset/config.py` or `superset/security/manager.py`. ### Prerequisites for API Key Authentication When using a newer release or running from `master` where PR #37973 is included: 1. **Flask-AppBuilder Upstream:** The feature requires a version of Flask-AppBuilder that implements API key storage and lookup (`api-key-auth`). 2. **Database Migration:** You must run: ```bash superset db upgrade superset init ``` to create the API keys table and register FAB permissions (`can_read`, `can_write` on `ApiKeyRestApi`). 3. **Configuration:** ```python # In superset_config.py FAB_API_KEY_ENABLED = True FAB_API_KEY_PREFIXES = ["sst_"] ``` In 6.1.0, authentication for automated scripts and REST APIs must continue using JWT access tokens generated via `POST /api/v1/security/login`. GitHub link: https://github.com/apache/superset/discussions/41603#discussioncomment-19164785 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
