For a team that wants to deploy models as APIs on Posit Connect the suggested workflow (as per the vetiver package) seems to be:
- Train a model
- Pin it
- Deploy an API that reads in the pinned model and generates predictions in response to POST requests.
My question is around authentication/permissions for the pinned model: unless we set its SHARING permissions to "Anyone - no login required" then anything trying to access it will need to authenticate with an API key. And I think I'm right in saying that the pins package would require us to authenticate anyway, regardless of what the SHARING permissions are. That means the API will need to authenticate in order to get the pinned model.
All of which sets up the question: what is the advised best/good practice for how to do this?
One option would be for the person that deploys the API to just use an API key of their own. This feels a bit like sharing secrets though, because we would want and expect that multiple team members will collaborate on the API.
Another option is to change the workflow slightly: rather than the API reading the pinned model directly, the person deploying the API pulls the pinned model down and deploys it in the API bundle itself. Now the API doesn't need to do any authentication, so it needs no API key. But this makes the bundle much larger, and means the API has to be redeployed whenever we change the model. Not a great hardship, but it is an extra step.
What's the right way to do this? Are we stressing unnecessarily about the API key in the first option?