> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thinkplatform.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Choose User guide for browser tasks, Developers for CLI, SDK and external agents, and Administration for organization management.
> Confirm identity and organization/project context before operations. Documentation access does not grant ThinkPlatform permissions.
> Review side effects, verify changes with a read, and do not blindly retry an operation with an uncertain outcome.
> Use documented UI steps for the web app and documented public CLI or SDK interfaces for automation. Follow each page’s prerequisites and authentication requirements.

# SDK authentication

> Choose explicit credentials, environment settings, or a CLI profile.

Import credentials and client factories from `thinkplatform.sdk`. The client normally acquires credentials when it makes a request, so authentication can fail even after client creation succeeds.

## Choose a credential

| Credential | Use and requirements |
| - | - |
| `StaticTokenCredential(token)` | A bearer token obtained outside the SDK. It does not renew the supplied token. Optional `expires_on`, `source`, and `claims` metadata can be supplied. |
| `AzureCliCredential()` | Uses Azure CLI authentication through Azure Identity. Requires an authenticated Azure CLI session and the API audience. |
| `DeviceCodeCredential(client_id=..., tenant_id=...)` | Uses an Azure Identity device-code flow. Requires an application client ID and audience. |
| `InteractiveBrowserCredential(client_id=..., tenant_id=...)` | Uses Azure Identity browser authentication. Requires an application client ID and audience. |
| `WorkspaceDelegationCredential(...)` | For a provisioned managed workspace: the managed identity, workspace ID or name, and workspace assertion are used to obtain a delegated token. Use the settings supplied by your workspace operator. |

Azure user credentials accept `env`, `tenant_id`, `client_id`, and `refresh_buffer_seconds`. Tenant and client IDs can also come from `THINKPLATFORM_AZURE_TENANT_ID` / `THINKPLATFORM_AZURE_CLIENT_ID`, falling back to their `AZURE_` equivalents. The audience is the API resource, not an arbitrary application ID; credentials append `/.default` when needed. These flows require Azure Identity dependencies and suitable tenant configuration.

The deployment must allow the application identity used by the selected credential. `AzureCliCredential` uses Azure CLI's application identity rather than the shared ThinkPlatform CLI registration; the deployment must explicitly allow Azure CLI. Browser and device-code flows require an approved public-client registration, not a web-only registration. Administrator consent for one API audience does not grant access to a different API audience.

A custom credential can implement the public `ThinkPlatformCredential` protocol: `get_token_info(*, base_url, audience, org_id=None, project_id=None, force_refresh=False)` returns `AccessTokenInfo`; `invalidate_cache()` clears its cached token. Keep token values out of logs.

The bearer-token examples in [resource workflows](https://docs.thinkplatform.ai/python-sdk/resources.md) read `THINKPLATFORM_ACCESS_TOKEN` themselves and pass it to `StaticTokenCredential`. This variable is used by the examples; `client_from_env()` does not automatically consume it.

## Environment configuration

```python theme={"system"}
from thinkplatform.sdk import client_from_env

with client_from_env() as client:
    print(client.base_url, client.org_id, client.project_id)
```

`client_from_env()` reads these settings; explicit factory arguments take precedence:

| Setting | Behavior |
| - | - |
| `THINKPLATFORM_API_BASE_URL` | API endpoint; falls back to `THINKPLATFORM_BASE_URL`, then `http://127.0.0.1:8000` for ordinary user auth. Set it explicitly for your deployment. |
| `THINKPLATFORM_API_AUDIENCE` | Falls back to `AZURE_API_AUDIENCE`; Azure credential scope resolution can also use `AZURE_CLIENT_ID`. |
| `THINKPLATFORM_AUTH_MODE` | Defaults to `azure-cli`; also accepts `device-code`, `interactive-browser`, `workspace-delegation`, or `execution-delegation`. |
| `THINKPLATFORM_ORG_ID`, `THINKPLATFORM_PROJECT_ID` | Integer context IDs. Values that cannot be parsed as integers leave the context unset. |

Workspace delegation requires an explicit API endpoint, `THINKPLATFORM_WORKSPACE_ASSERTION`, and `THINKPLATFORM_WORKSPACE_ID` or `THINKPLATFORM_WORKSPACE_NAME`. Name-based lookup also requires organization and project context. Requested scopes can be supplied through `THINKPLATFORM_WORKSPACE_SCOPES` or `THINKPLATFORM_REQUESTED_SCOPES`.

Execution delegation uses the `THINKPLATFORM_EXECUTION_TOKEN`, endpoint, and positive organization and project IDs injected by a trusted caller. It is bound to that context, requires relative request paths, and cannot renew an expired execution credential by falling back to a user login. Use the injected token; do not construct execution tokens yourself or embed them in source code.

## Reuse a CLI profile explicitly

```python theme={"system"}
from thinkplatform.sdk import client_from_profile

with client_from_profile("work") as client:
    print(client.org_id, client.project_id)
```

`client_from_profile()` loads local CLI profile configuration and uses the CLI's connection defaults when the profile has no value for a setting. For the production URL and audience, browser and device-code credentials use the same encrypted OS token cache and non-secret account record as the CLI. The OS credential store must be available; the SDK does not fall back to plaintext token storage. It accepts `config_path`, `env`, and explicit `base_url`, `audience`, `auth_mode`, `org_id`, `project_id`, and `timeout_seconds` overrides. If you omit the profile name, it selects a profile using the CLI rules, including the profile selected through the environment or the active profile. It creates the credential configured in the profile rather than converting the profile to a static bearer token.

`ThinkPlatformClient(...)` and `client_from_env()` do **not** automatically load CLI profiles or inherit the CLI's public-service defaults. The constructor uses values you pass directly; `client_from_env()` follows the SDK environment table above, including its `http://127.0.0.1:8000` base URL and `azure-cli` auth defaults. See [CLI authentication](https://docs.thinkplatform.ai/cli/get-started/authentication.md) and [context](https://docs.thinkplatform.ai/cli/guides/context.md). Exact constructor and factory signatures are in the [API reference](https://docs.thinkplatform.ai/python-sdk/api-reference.md).

## Hosted App requests

Inside a configured Hosted App, use `client_from_hosted_request(request.headers)` for each authenticated request and close the client before the request ends. Do not inject a personal CLI token or reuse an invocation in background work. See [Hosted Apps](https://docs.thinkplatform.ai/python-sdk/hosted-apps.md) for grants and lifecycle requirements.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.