client.tokens

client.tokens — the tokens operations.

On AsyncKindgi every method is the same, awaited.

client.tokens.list()

list(
    *,
    cursor: str | None = None,
    limit: int | None = None,
    principal: str | None = None,
    timeout: float | None = None,
) -> ApiTokenPage

Signature

List API keys. GET /v1/tokens

Newest first. Never returns secrets. A tenant admin sees every key (?principal= for one principal's); anyone else sees their own.

client.tokens.mint()

mint(
    body: MintTokenBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> MintTokenResult

Signature

Mint an API key. POST /v1/tokens

An API key acts for one principal (for: a person or a service account; default the caller), with that principal's grants. Its role is a ceiling under them and its projectId a limit. Returns the plaintext token exactly once. A person or a service account's key mints its own keys; only a tenant admin mints for someone else, or an admin key. A caller can only grant capabilities it holds, and a key limited to a project mints only keys limited to it. A key that expires mints only keys that expire no later than it, and a session opened by token sign-in mints as the key it was opened with. Only mounted when the deployment supplies a TokenAdmin.

client.tokens.get()

get(token_id: str | UUID, /, *, timeout: float | None = None) -> ApiToken

Signature

Read an API key. GET /v1/tokens/{tokenId}

Never returns the secret. A tenant admin reads any key; anyone else only their own (someone else's reads as missing).

client.tokens.revoke()

revoke(
    token_id: str | UUID,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
) -> RevokeTokenResult

Signature

Revoke an API key. POST /v1/tokens/{tokenId}/revoke

Takes effect on the next request. A tenant admin revokes any key; anyone else only their own.

client.tokens.mint_public()

mint_public(
    body: MintPublicRunTokenBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> MintPublicRunTokenResult

Signature

Mint a public run token. POST /v1/tokens/public

A short-lived, read-only token for up to 50 runs (and their descendants), to hand to a browser: it can only call GET /v1/runs/{runId}/progress and GET /v1/runs/{runId}/progress/stream. Stateless: it cannot be revoked one by one, so keep lifetimes short. Mounted when the deployment issues public run tokens.