Personal Access Token Authentication Failures

[millibyte-products]

Describe the bug
Using local files and running the server and ml backend locally, personal access tokens refuse to authenticate.
Legacy tokens must be used.

To Reproduce
Steps to reproduce the behavior:

1. Install Label Studio (1.22.0 at time of writing)
2. Configure local file storage (with appropriate environment variables)
3. Configure a ml backend (YOLO)
4. Create a test project
5. Add YOLO ml backend to test project using personal access token
6. Submit test request from model connection settings
7. Error 401 appears in debug logs, test request fails

Expected behavior
I expect an recently created personal access token to authenticate the request.

• A legacy token bypasses this issue
• Multiple PATs were tried
• Static files serve normally in a web-browser using data/local-files urls

ML backend logs:

[2026-03-06 17:14:04,546] [INFO] [model::predict::107] Run prediction on 1 tasks, project ID = 1
[2026-03-06 17:14:04,547] [INFO] [control_models.base::create::96] Skipping control tag 'RectangleLabels' with name 'keypoints_bbox', model_skip=true found
[2026-03-06 17:14:04,547] [DEBUG] [model::detect_control_models::61] No instance created for RectangleLabels keypoints_bbox
[2026-03-06 17:14:04,547] [DEBUG] [label_studio_ml.model::build_label_map::380] Labels supported by model for keypoints: dict_values(['person'])
[2026-03-06 17:14:04,547] [DEBUG] [label_studio_ml.model::build_label_map::404] Model Labels <=> Label Studio Labels:
{'person': 'right_ankle'}
[2026-03-06 17:14:04,548] [DEBUG] [model::detect_control_models::84] Control tag with model detected: KeyPointLabels from_name=keypoints, label_map={'person': 'right_ankle'}, model_score_threshold=0.75
[2026-03-06 17:14:04,548] [DEBUG] [label_studio_sdk._extensions.label_studio_tools.core.utils.io::get_local_path::139] Image and upload dirs: image_dir=/home/user/.local/share/label-studio/media/upload, upload_dir=/home/user/.local/share/label-studio/media/upload
[2026-03-06 17:14:04,548] [INFO] [label_studio_sdk._extensions.label_studio_tools.core.utils.io::get_local_path::166] Resolving url using hostname [http://tower.lan:8081/]: http://tower.lan:8081/data/local-files/?d=samples/frame17_780.png
[2026-03-06 17:14:04,548] [INFO] [label_studio_sdk._extensions.label_studio_tools.core.utils.io::download_and_cache::227] Download http://tower.lan:8081/data/local-files/?d=samples/frame17_780.png to /home/user/.cache/label-studio/6b297f46__frame17_780.png. download_resources: True
[2026-03-06 17:14:04,549] [DEBUG] [label_studio_sdk._extensions.label_studio_tools.core.utils.io::download_and_cache::247] Authorization token is used for download_and_cache
[2026-03-06 17:14:04,568] [DEBUG] [urllib3.connectionpool::_new_conn::241] Starting new HTTP connection (1): tower.lan:8081
[2026-03-06 17:14:04,586] [DEBUG] [urllib3.connectionpool::_make_request::544] http://tower.lan:8081 "GET /data/local-files/?d=samples/frame17_780.png HTTP/1.1" 401 160
[2026-03-06 17:14:04,605] [ERROR] [label_studio_ml.exceptions::exception_f::53] Traceback (most recent call last):
  File "/home/user/.pyenv/versions/3.11.13/lib/python3.11/site-packages/label_studio_ml/exceptions.py", line 39, in exception_f
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "/home/user/.pyenv/versions/3.11.13/lib/python3.11/site-packages/label_studio_ml/api.py", line 69, in _predict
    response = model.predict(tasks, context=context, **params)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/mnt/bulk/workspace/project/project_ls_backend/model.py", line 117, in predict
    path = model.get_path(task)
           ^^^^^^^^^^^^^^^^^^^^
  File "/mnt/bulk/workspace/project/project_ls_backend/control_models/base.py", line 187, in get_path
    else get_local_path(task_path, task_id=task.get("id"))
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.pyenv/versions/3.11.13/lib/python3.11/site-packages/label_studio_sdk/_extensions/label_studio_tools/core/utils/io.py", line 188, in get_local_path
    filepath = download_and_cache(
               ^^^^^^^^^^^^^^^^^^^
  File "/home/user/.pyenv/versions/3.11.13/lib/python3.11/site-packages/label_studio_sdk/_extensions/label_studio_tools/core/utils/io.py", line 250, in download_and_cache
    r.raise_for_status()
  File "/home/user/.pyenv/versions/3.11.13/lib/python3.11/site-packages/requests/models.py", line 1026, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: http://tower.lan:8081/data/local-files/?d=samples/frame17_780.png

Traceback (most recent call last):
  File "/home/user/.pyenv/versions/3.11.13/lib/python3.11/site-packages/label_studio_ml/exceptions.py", line 39, in exception_f
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "/home/user/.pyenv/versions/3.11.13/lib/python3.11/site-packages/label_studio_ml/api.py", line 69, in _predict
    response = model.predict(tasks, context=context, **params)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/mnt/bulk/workspace/project/project_ls_backend/model.py", line 117, in predict
    path = model.get_path(task)
           ^^^^^^^^^^^^^^^^^^^^
  File "/mnt/bulk/workspace/project/project_ls_backend/control_models/base.py", line 187, in get_path
    else get_local_path(task_path, task_id=task.get("id"))
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.pyenv/versions/3.11.13/lib/python3.11/site-packages/label_studio_sdk/_extensions/label_studio_tools/core/utils/io.py", line 188, in get_local_path
    filepath = download_and_cache(
               ^^^^^^^^^^^^^^^^^^^
  File "/home/user/.pyenv/versions/3.11.13/lib/python3.11/site-packages/label_studio_sdk/_extensions/label_studio_tools/core/utils/io.py", line 250, in download_and_cache
    r.raise_for_status()
  File "/home/user/.pyenv/versions/3.11.13/lib/python3.11/site-packages/requests/models.py", line 1026, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: http://tower.lan:8081/data/local-files/?d=samples/frame17_780.png

Label Studio logs:

[2026-03-06 22:14:01,870] [django.server::log_message::213] [INFO] "GET /api/current-user/whoami HTTP/1.1" 200 1218
[2026-03-06 22:14:04,582] [core.utils.common::custom_exception_handler::97] [ERROR] 6beb2189-5990-4565-ad43-3ada5ad185d5 Authentication credentials were not provided.
Traceback (most recent call last):
  File "/home/user/.pyenv/versions/labelstudio/lib/python3.13/site-packages/rest_framework/views.py", line 497, in dispatch
    self.initial(request, *args, **kwargs)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.pyenv/versions/labelstudio/lib/python3.13/site-packages/sentry_sdk/integrations/django/__init__.py", line 333, in sentry_patched_drf_initial
    return old_drf_initial(self, request, *args, **kwargs)
  File "/home/user/.pyenv/versions/labelstudio/lib/python3.13/site-packages/rest_framework/views.py", line 415, in initial
    self.check_permissions(request)
    ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/home/user/.pyenv/versions/labelstudio/lib/python3.13/site-packages/rest_framework/views.py", line 333, in check_permissions
    self.permission_denied(
    ~~~~~~~~~~~~~~~~~~~~~~^
        request,
        ^^^^^^^^
        message=getattr(permission, 'message', None),
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        code=getattr(permission, 'code', None)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/home/user/.pyenv/versions/labelstudio/lib/python3.13/site-packages/rest_framework/views.py", line 174, in permission_denied
    raise exceptions.NotAuthenticated()
rest_framework.exceptions.NotAuthenticated: Authentication credentials were not provided.
[2026-03-06 22:14:04,585] [django.request::log_response::253] [WARNING] Unauthorized: /data/local-files/
[2026-03-06 22:14:04,585] [django.request::log_response::253] [WARNING] Unauthorized: /data/local-files/

Environment (please complete the following information):

• OS: Linux (Debian 12)
• Label Studio Version 1.22.0
• Python 3.11.13

[heidi-humansignal]

Hello,

Thank you for contacting Label Studio,
Currently, ML backends support only Legacy Tokens and do not support Personal Tokens. You will encounter an Unauthorized Error if you use Personal Tokens.

Best Regards!

Comment by Oussama Assili
Workflow Run