[SIMPLE] Flight returned unauthenticated error

[FranciscoFreiriaCurious]

Doing the usual code to get traces export:

primary_df = client.export_model_to_df(
    space_id='U3BhY2U6MjA4OnJMc2M=',
    model_id='DocHub-Agent-Local',
    environment=Environments.TRACING,
    start_time=datetime.fromisoformat('2026-01-12T09:00:00.000+00:00'),
    end_time=datetime.fromisoformat('2026-01-13T09:12:33.245+00:00'),
    where="context.trace_id = \"fadcb9824f992dd05b9df69e58712d84\"",
    # Optionally specify columns to improve query performance
    # columns=['context.span_id', 'attributes.llm.input']
)

I cannot authenticate into Flight:

   flight_info = client.get_flight_info(
                  ^^^^^^^^^^^^^^^^^^^^^^^
  File "pyarrow/_flight.pyx", line 1712, in pyarrow._flight.FlightClient.get_flight_info
  File "pyarrow/_flight.pyx", line 64, in pyarrow._flight.check_flight_status
pyarrow._flight.FlightUnauthenticatedError: Flight returned unauthenticated error, with message: auth-error: rpc error: code = PermissionDenied desc = Unable to authenticate

I already tried to use User API Key and Service Key which not helped.
Anyone knows how to solve? Thanks

[dosubot[bot]]

Hi @FranciscoFreiria-siemens! I'm Dosu and I’m helping the phoenix team.

The FlightUnauthenticatedError usually means the Phoenix client isn't sending the expected authentication headers to the Flight/gRPC endpoint. Here’s a checklist to help resolve it:

• Make sure you set the PHOENIX_API_KEY environment variable to your API key before you instantiate the client. This variable is used to add an Authorization: Bearer header to all requests, including Flight/gRPC exports. For self-hosted Phoenix, this is the standard approach; for Phoenix Cloud, you may need to set PHOENIX_CLIENT_HEADERS to api_key=... instead, depending on your deployment. See details and docs.
• If you’re setting headers manually, ensure the header name is lowercased (authorization) for gRPC compatibility, and the value is in the Bearer format.
• Double-check that PHOENIX_COLLECTOR_ENDPOINT points to the correct endpoint for your deployment. Endpoint mismatches or confusion between PHOENIX_COLLECTOR_ENDPOINT and PHOENIX_HOST/base_url can cause authentication failures, especially if the client is using the wrong base URL internally (source).
• Set all relevant environment variables before importing or instantiating the Phoenix client in your code.
• If you’re using run_experiment or similar helpers, prefer instantiating your own Client with explicit base_url and api_key, then call methods on that instance to avoid environment variable confusion (source).

If you’ve confirmed all of the above and still see the error, check for network/proxy/firewall issues that might be stripping headers or blocking requests, and review server logs for more details.

Let me know if you want a minimal working example for your setup.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[fjcasti1]

@FranciscoFreiriaCurious Are you trying to use Arize AX (enterprise product) or Arize Phoenix (Open Source)? The reason I ask is because the issue is filed under the Phoenix repo but the Flight server is only available in the AX product, not Phoenix. Would you give a bit more detail on your usecase and what you're trying to accomplish? cc @axiomofjoy

[FranciscoFreiriaCurious]

It is Arize AX but I did not see the discussion topics under Arize AX. I can close the topic since the problem is solved. For further similar problems. Have in consideration that export_model_to_df() is part of the https://flight.arize.com/ API and the list of host per region is listed here:

https://arize.com/docs/ax/security-and-settings/whitelisting