Use the SDK inside a Hosted App

Use ThinkPlatform-client 0.6.134 inside a published Hosted App. The deployment must enable Hosted Apps and its SDK gateway, and the app must declare its required permissions at publication. See Publish a web app before adding data access.

Create a client for one request

Import client_from_hosted_request from thinkplatform.sdk and pass the incoming backend request headers. The platform supplies the gateway address and short-lived invocation information; no personal token or client secret belongs in your app image.

from thinkplatform.sdk import client_from_hosted_request

def read_items(request_headers, table_id):
    with client_from_hosted_request(request_headers) as client:
        result = client.db.rows.query(table_id, {"page_size": 5})
        return [{"id": row.id, "data": row.data} for row in result.items]

Call read_items inside your application’s current authenticated request. Pass the actual request headers and a configured Table ID covered by --table-read. It returns up to five row IDs and their business values. The SDK is synchronous; an async server should run this work through its framework’s supported thread-pool adapter. Close the client before that request finishes. Do not keep the headers, invocation handle or client in global state or background jobs. A browser cookie or a caller-supplied header from an arbitrary public endpoint is not a substitute for the configured Hosted App gateway. Missing or invalid invocation information raises TokenAcquisitionError.

Match the app’s permission grant

App operation	Publication permission	Verification
Read selected Table rows	`--table-read TABLE_ID`	Query an allowed Table and check the returned row values.
Write selected Table rows	`--table-write TABLE_ID`	Write the intended record and perform a separate authorized readback.
Read the project Lakehouse	`--lakehouse-read`	Submit a read-only statement and inspect its status and results.
Supported project API reads	Repeated `--project-permission` values	Check the accepted values in `tp apps publish --help` and test the intended read.

The user’s current permissions and the app’s declared grant must both allow the operation. A method appearing in the SDK does not mean the delegated gateway permits every operation in that namespace. Do not retry 401/403 with an operator token or a stronger identity. Review the grant, consent, project and user’s access instead.

Query the Lakehouse

Within the same request, use client.lakehouse.statements.execute("SELECT 1 AS example", wait_timeout="0s"), then inspect the returned statement ID and state. Submission and completion are separate. Fetch status or chunks only within a valid authenticated app request; make a fresh request if the earlier invocation has ended. See Lakehouse statements for the SDK methods and result representation.

Publish from an external SDK client

Outside the app, an authorized developer client can use client.hosted_apps.publish(...) for an image, publish_source(...) for a gzip source context, list(), get(app_id) and stop(app_id, release). These are management calls; the request-bound app client is for the supported delegated data operations. The API reference lists exact signatures. Source publication accepts a compressed context of at most 50 MiB and supports resumption with the same UUID and inputs. A submission returns a HostedAppDeployment; it is not proof of readiness. Inspect the recorded release and application URL before reporting success.

Get started

CLI

Python SDK

Agent skills

Create a client for one request

Match the app’s permission grant

Query the Lakehouse

Publish from an external SDK client

​Create a client for one request

​Match the app’s permission grant

​Query the Lakehouse

​Publish from an external SDK client

Create a client for one request

Match the app’s permission grant

Query the Lakehouse

Publish from an external SDK client