SDK authentication

Import credentials and client factories from thinkplatform.sdk. The client normally acquires credentials when it makes a request, so authentication can fail even after client creation succeeds.

Choose a credential

Credential	Use and requirements
`StaticTokenCredential(token)`	A bearer token obtained outside the SDK. It does not renew the supplied token. Optional `expires_on`, `source`, and `claims` metadata can be supplied.
`AzureCliCredential()`	Uses Azure CLI authentication through Azure Identity. Requires an authenticated Azure CLI session and the API audience.
`DeviceCodeCredential(client_id=..., tenant_id=...)`	Uses an Azure Identity device-code flow. Requires an application client ID and audience.
`InteractiveBrowserCredential(client_id=..., tenant_id=...)`	Uses Azure Identity browser authentication. Requires an application client ID and audience.
`WorkspaceDelegationCredential(...)`	For a provisioned managed workspace: the managed identity, workspace ID or name, and workspace assertion are used to obtain a delegated token. Use the settings supplied by your workspace operator.

Azure user credentials accept env, tenant_id, client_id, and refresh_buffer_seconds. Tenant and client IDs can also come from THINKPLATFORM_AZURE_TENANT_ID / THINKPLATFORM_AZURE_CLIENT_ID, falling back to their AZURE_ equivalents. The audience is the API resource, not an arbitrary application ID; credentials append /.default when needed. These flows require Azure Identity dependencies and suitable tenant configuration. The deployment must allow the application identity used by the selected credential. AzureCliCredential uses Azure CLI’s application identity rather than the shared ThinkPlatform CLI registration; the deployment must explicitly allow Azure CLI. Browser and device-code flows require an approved public-client registration, not a web-only registration. Administrator consent for one API audience does not grant access to a different API audience. A custom credential can implement the public ThinkPlatformCredential protocol: get_token_info(*, base_url, audience, org_id=None, project_id=None, force_refresh=False) returns AccessTokenInfo; invalidate_cache() clears its cached token. Keep token values out of logs. The bearer-token examples in resource workflows read THINKPLATFORM_ACCESS_TOKEN themselves and pass it to StaticTokenCredential. This variable is used by the examples; client_from_env() does not automatically consume it.

Environment configuration

from thinkplatform.sdk import client_from_env

with client_from_env() as client:
    print(client.base_url, client.org_id, client.project_id)

client_from_env() reads these settings; explicit factory arguments take precedence:

Setting	Behavior
`THINKPLATFORM_API_BASE_URL`	API endpoint; falls back to `THINKPLATFORM_BASE_URL`, then `http://127.0.0.1:8000` for ordinary user auth. Set it explicitly for your deployment.
`THINKPLATFORM_API_AUDIENCE`	Falls back to `AZURE_API_AUDIENCE`; Azure credential scope resolution can also use `AZURE_CLIENT_ID`.
`THINKPLATFORM_AUTH_MODE`	Defaults to `azure-cli`; also accepts `device-code`, `interactive-browser`, `workspace-delegation`, or `execution-delegation`.
`THINKPLATFORM_ORG_ID`, `THINKPLATFORM_PROJECT_ID`	Integer context IDs. Values that cannot be parsed as integers leave the context unset.

Workspace delegation requires an explicit API endpoint, THINKPLATFORM_WORKSPACE_ASSERTION, and THINKPLATFORM_WORKSPACE_ID or THINKPLATFORM_WORKSPACE_NAME. Name-based lookup also requires organization and project context. Requested scopes can be supplied through THINKPLATFORM_WORKSPACE_SCOPES or THINKPLATFORM_REQUESTED_SCOPES. Execution delegation uses the THINKPLATFORM_EXECUTION_TOKEN, endpoint, and positive organization and project IDs injected by a trusted caller. It is bound to that context, requires relative request paths, and cannot renew an expired execution credential by falling back to a user login. Use the injected token; do not construct execution tokens yourself or embed them in source code.

Reuse a CLI profile explicitly

from thinkplatform.sdk import client_from_profile

with client_from_profile("work") as client:
    print(client.org_id, client.project_id)

client_from_profile() loads local CLI profile configuration and uses the CLI’s connection defaults when the profile has no value for a setting. For the production URL and audience, browser and device-code credentials use the same encrypted OS token cache and non-secret account record as the CLI. The OS credential store must be available; the SDK does not fall back to plaintext token storage. It accepts config_path, env, and explicit base_url, audience, auth_mode, org_id, project_id, and timeout_seconds overrides. If you omit the profile name, it selects a profile using the CLI rules, including the profile selected through the environment or the active profile. It creates the credential configured in the profile rather than converting the profile to a static bearer token. ThinkPlatformClient(...) and client_from_env() do not automatically load CLI profiles or inherit the CLI’s public-service defaults. The constructor uses values you pass directly; client_from_env() follows the SDK environment table above, including its http://127.0.0.1:8000 base URL and azure-cli auth defaults. See CLI authentication and context. Exact constructor and factory signatures are in the API reference.

Hosted App requests

Inside a configured Hosted App, use client_from_hosted_request(request.headers) for each authenticated request and close the client before the request ends. Do not inject a personal CLI token or reuse an invocation in background work. See Hosted Apps for grants and lifecycle requirements.

Get started

CLI

Python SDK

Agent skills

Choose a credential

Environment configuration

Reuse a CLI profile explicitly

Hosted App requests

​Choose a credential

​Environment configuration

​Reuse a CLI profile explicitly

​Hosted App requests

Choose a credential

Environment configuration

Reuse a CLI profile explicitly

Hosted App requests