> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thinkplatform.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Choose User guide for browser tasks, Developers for CLI, SDK and external agents, and Administration for organization management.
> Confirm identity and organization/project context before operations. Documentation access does not grant ThinkPlatform permissions.
> Review side effects, verify changes with a read, and do not blindly retry an operation with an uncertain outcome.
> Use documented UI steps for the web app and documented public CLI or SDK interfaces for automation. Follow each page’s prerequisites and authentication requirements.

# Use the SDK inside a Hosted App

> Access project data through the current app request with narrowly declared permissions.

Use **ThinkPlatform-client 0.6.134** inside a published Hosted App. The deployment must enable Hosted Apps and its SDK gateway, and the app must declare its required permissions at publication. See [Publish a web app](https://docs.thinkplatform.ai/cli/guides/apps.md) before adding data access.

## Create a client for one request

Import `client_from_hosted_request` from `thinkplatform.sdk` and pass the incoming backend request headers. The platform supplies the gateway address and short-lived invocation information; no personal token or client secret belongs in your app image.

```python theme={"system"}
from thinkplatform.sdk import client_from_hosted_request

def read_items(request_headers, table_id):
    with client_from_hosted_request(request_headers) as client:
        result = client.db.rows.query(table_id, {"page_size": 5})
        return [{"id": row.id, "data": row.data} for row in result.items]
```

Call `read_items` inside your application's current authenticated request. Pass the actual request headers and a configured Table ID covered by `--table-read`. It returns up to five row IDs and their business values. The SDK is synchronous; an async server should run this work through its framework's supported thread-pool adapter.

Close the client before that request finishes. Do not keep the headers, invocation handle or client in global state or background jobs. A browser cookie or a caller-supplied header from an arbitrary public endpoint is not a substitute for the configured Hosted App gateway. Missing or invalid invocation information raises `TokenAcquisitionError`.

## Match the app's permission grant

| App operation | Publication permission | Verification |
| - | - | - |
| Read selected Table rows | `--table-read TABLE_ID` | Query an allowed Table and check the returned row values. |
| Write selected Table rows | `--table-write TABLE_ID` | Write the intended record and perform a separate authorized readback. |
| Read the project Lakehouse | `--lakehouse-read` | Submit a read-only statement and inspect its status and results. |
| Supported project API reads | Repeated `--project-permission` values | Check the accepted values in `tp apps publish --help` and test the intended read. |

The user's current permissions and the app's declared grant must both allow the operation. A method appearing in the SDK does not mean the delegated gateway permits every operation in that namespace. Do not retry 401/403 with an operator token or a stronger identity. Review the grant, consent, project and user's access instead.

## Query the Lakehouse

Within the same request, use `client.lakehouse.statements.execute("SELECT 1 AS example", wait_timeout="0s")`, then inspect the returned statement ID and state. Submission and completion are separate. Fetch status or chunks only within a valid authenticated app request; make a fresh request if the earlier invocation has ended. See [Lakehouse statements](https://docs.thinkplatform.ai/python-sdk/lakehouse.md) for the SDK methods and result representation.

## Publish from an external SDK client

Outside the app, an authorized developer client can use `client.hosted_apps.publish(...)` for an image, `publish_source(...)` for a gzip source context, `list()`, `get(app_id)` and `stop(app_id, release)`. These are management calls; the request-bound app client is for the supported delegated data operations. The [API reference](https://docs.thinkplatform.ai/python-sdk/api-reference.md#hosted-apps) lists exact signatures.

Source publication accepts a compressed context of at most 50 MiB and supports resumption with the same UUID and inputs. A submission returns a `HostedAppDeployment`; it is not proof of readiness. Inspect the recorded release and application URL before reporting success.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.