Add option to enable legacy API token by default

[harrymander]

Is your feature request related to a problem? Please describe.
v1.17.0 has added JWT authentication. However we would still like to use the legacy API tokens. The user token can be set via the --user-token CLI flag or LABEL_STUDIO_USER_TOKEN env var; however, the legacy token is still disabled by default (have to manually enable in the org settings in the web UI).

Describe the solution you'd like
A CLI flag e.g. --enable-legacy-api-token and corresponding environment variable LABEL_STUDIO_ENABLE_LEGACY_API_TOKEN to enable the legacy token that was set via --user-token/LABEL_STUDIO_USER_TOKEN.

Describe alternatives you've considered
None

Additional context
N/A

[heidi-humansignal]

Hello,

Thank you for contacting Label Studio,

I will make sure to pass along the request to the appropriate team for further consideration!

Much Appreciated!

Comment by Oussama Assili
Workflow Run

[GuillaumeDorschner]

+1 same

[cmacpherson-altaML]

+1 As well. Looking for an option in the xml config to set the token mode without having to use the UI.

[benglewis]

I worked with GitHub Copilot Workspace a little and produced a PR that looks like in theory it should work. I will admit that I haven't tested it yet. See PR: #7388

[caitlinwheeless]

Can you clarify what you mean with this issue? The legacy token should not be disabled by default anywhere unless you're creating a new Label Studio organization.

[harrymander]

@caitlinwheeless If that is the expected behaviour then this may be a bug? This is how I reproduce it:

Start Label Studio in a docker container:

docker run --rm -it -p 8080:8080 \
  -e LABEL_STUDIO_USERNAME="admin@localhost.com" \
  -e LABEL_STUDIO_PASSWORD=password123 \
  -e LABEL_STUDIO_USER_TOKEN=11e3fb99e0ce36e794da356fd81d5e5d \
  heartexlabs/label-studio:1.17.0 label-studio

Go to web UI and log in with above username and password. Go to Organisation -> API Token Settings, the Legacy Tokens option is disabled.

When you enable it and go to Account & Settings -> Legacy token, the token passed to the docker run command will be listed.

[harrymander]

Same behaviour when run directly from Python package:

label-studio \
  --username "admin@localhost.com"  \
  --password password123 \
  --user-token 11e3fb99e0ce36e794da356fd81d5e5d \
  --data-dir ./data

Also get the same behaviour if you start the server without specifying a default user and password and create a new user in the UI.

[caitlinwheeless]

@harrymander thanks for clarifying!

And to confirm, you're NOT creating a new Label Studio organization? Is there a reason why setting it in the UI is blocking you?

[cmacpherson-altaML]

I am not creating a new organization, I am using the default one. The default one comes up using PAT.

The reason setting it in the UI is a blocker for me is because it adds a very manual step to our application deployment. The API token being used is legacy and authentication with the label studio container fails until we manually load the application in a web browser and use the UI to turn on legacy tokens.

It would be super helpful if it were a setting that was exposed via the XML config.

[harrymander]

@caitlinwheeless Not really sure what you mean by "creating an organization" - I am creating a new locally-hosted instance of Label Studio using those exact steps. I'm not using the the Cloud/Enterprise platforms.

My use case is similar to @cmacpherson-altaML's above

[pakelley]

Hey all, wanted to chime in here: I think I see what you're trying to do, but just to make sure is this basically it?

• You are spinning up a fresh label studio instance each time you run this command, with no pre-existing data
• You want to govern the api token yourself, so that you can ensure some downstream automation has access (i.e. the automation has set it's access key prior to spinning up label studio). Because of this, the JWT auth doesn't work since you can't control the key via the env var

Is that correct?

[harrymander]

Yes that's correct!

[pakelley]

Ok fantastic, makes sense. Going to request a couple changes on @benglewis 's PR, but overall it lgtm 🙂

[pakelley]

It would be super helpful if it were a setting that was exposed via the XML config.

@cmacpherson-altaML You mean the label config, right? Unfortunately that configures a "Project", whereas this setting is at the "Organization" level. It sounds like for your use case there probably isn't much of a difference, but because of the structure of the application that config really doesn't have access to org-level settings.

Would the cli option that @benglewis 's PR adds work for your use case?