honcho-cli 0.1.1__tar.gz → 0.1.2__tar.gz

{honcho_cli-0.1.1 → honcho_cli-0.1.2}/.gitignore

@@ -193,3 +193,6 @@ metrics.jsonl
 AGENTS.md
 lancedb_data/
 grafana-data/
+
+# Claude Code addon stuff
+.omc

{honcho_cli-0.1.1 → honcho_cli-0.1.2}/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [0.1.2] - 2026-07-20
+
+### Added
+
+- Device-code OAuth login for managed Honcho servers. `honcho init` now offers browser-based login (RFC 8628 device authorization grant) when the host advertises the device grant in its OAuth authorization-server metadata; tokens are persisted to `~/.honcho/config.json` and auto-refreshed (#891)
+
 ## [0.1.1] - 2026-06-15
 
 ### Fixed

{honcho_cli-0.1.1 → honcho_cli-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: honcho-cli
-Version: 0.1.1
+Version: 0.1.2
 Summary: A terminal for Honcho — memory that reasons.
 Project-URL: Homepage, https://github.com/plastic-labs/honcho
 Project-URL: Repository, https://github.com/plastic-labs/honcho

{honcho_cli-0.1.1 → honcho_cli-0.1.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "honcho-cli"
-version = "0.1.1"
+version = "0.1.2"
 description = "A terminal for Honcho — memory that reasons."
 readme = "README.md"
 requires-python = ">=3.11"

{honcho_cli-0.1.1 → honcho_cli-0.1.2}/src/honcho_cli/__init__.py

@@ -1,3 +1,3 @@
 """Honcho CLI — a terminal for Honcho."""
 
-__version__ = "0.1.0"
+__version__ = "0.1.2"

{honcho_cli-0.1.1 → honcho_cli-0.1.2}/src/honcho_cli/commands/setup.py

@@ -7,6 +7,8 @@
 from __future__ import annotations
 
 import json
+import time
+import webbrowser
 
 import typer
 from honcho import (
@@ -19,13 +21,14 @@ from honcho import (
 from rich.console import Console
 from rich.panel import Panel
 
-from honcho_cli import __version__
+from honcho_cli import __version__, oauth
 from honcho_cli.branding import BANNER, BRAND, ICON_FAIL, ICON_OK, ICON_RUN
-from honcho_cli.common import get_resolved_config
+from honcho_cli.common import get_resolved_config, maybe_refresh_token
 from honcho_cli.config import (
     CONFIG_FILE,
     DEFAULT_BASE_URL,
     CLIConfig,
+    OAuthTokens,
 )
 from honcho_cli.output import print_error, print_result, set_json_mode, use_json
 
@@ -117,21 +120,142 @@ def init(
         _console.print()
         _console.print()
 
+    # Non-interactive (JSON/piped) or an explicit --api-key: manual-key path.
+    # Device login needs a human at a browser, so it's TTY-only.
+    if use_json() or api_key:
+        _init_manual_key(key_val, url_val, file_key, file_url)
+    else:
+        _init_interactive(key_val, url_val, file_url)
+
+
+def _init_manual_key(key_val: str, url_val: str, file_key: str, file_url: str) -> None:
+    """Non-interactive path: confirm/save apiKey + URL, no device login."""
     final_key = _prompt_api_key(key_val)
     final_url = _prompt_url(url_val)
-
-    # Persist if anything changed or if the value came from env/flag.
     if final_key != file_key or final_url != file_url:
         CLIConfig(base_url=final_url, api_key=final_key).save()
         if not use_json():
             _console.print(f"  {ICON_OK} [dim]Saved to {CONFIG_FILE}[/dim]")
-
     _check_connection(final_url, final_key)
-
     if use_json():
         print_result({"apiKey": _redact(final_key), "baseUrl": final_url})
 
 
+def _init_interactive(key_val: str, url_val: str, file_url: str) -> None:
+    """Interactive path: URL first (device flow needs the host), then auth method."""
+    final_url = _prompt_url(url_val)
+    existing = CLIConfig.load()
+    has_creds = bool(key_val) or bool(existing.oauth and existing.oauth.access_token)
+    # only offer browser login if the host advertises the device grant (managed)
+    device_available = oauth.supports_device_login(final_url)
+    method = _prompt_auth_method(has_creds, device_available)
+
+    if method == "keep":
+        if final_url != file_url:
+            existing.base_url = final_url
+            existing.save()
+            _console.print(f"  {ICON_OK} [dim]Saved to {CONFIG_FILE}[/dim]")
+        # refresh an expired token so "keep" behaves like every live command;
+        # a failed refresh surfaces as the connectivity check below, not an abort
+        try:
+            maybe_refresh_token(existing)
+        except typer.Exit:
+            pass
+        _check_connection(final_url, existing.resolved_api_key())
+        return
+
+    if method == "device":
+        tokens = _device_login(final_url)
+        CLIConfig(base_url=final_url, oauth=tokens).save()
+        _console.print(f"  {ICON_OK} [dim]Saved to {CONFIG_FILE}[/dim]")
+        _check_connection(final_url, tokens.access_token)
+        return
+
+    # paste a key
+    final_key = _prompt_api_key("")
+    CLIConfig(base_url=final_url, api_key=final_key).save()
+    _console.print(f"  {ICON_OK} [dim]Saved to {CONFIG_FILE}[/dim]")
+    _check_connection(final_url, final_key)
+
+
+def _prompt_auth_method(has_creds: bool, device_available: bool) -> str:
+    """Ask how to authenticate. Returns ``device`` / ``key`` / ``keep``.
+
+    ``device`` is only offered when the host advertises the device grant; when
+    it doesn't, pasting a key is the only login path.
+    """
+    _console.print("  [dim]How do you want to authenticate?[/dim]")
+    options: list[str] = []
+    if device_available:
+        options.append("device")
+        _console.print(f"  [dim]({len(options)})[/dim] Log in with your browser (device code)")
+    options.append("key")
+    _console.print(f"  [dim]({len(options)})[/dim] Paste an API key")
+    if has_creds:
+        options.append("keep")
+        _console.print(f"  [dim]({len(options)})[/dim] Keep current credentials")
+    # default to keeping existing creds so a returning user pressing Enter doesn't
+    # get dropped into an unwanted browser login that overwrites them
+    default = str(options.index("keep") + 1) if "keep" in options else "1"
+    choice = typer.prompt("  Choice", default=default, show_default=True, prompt_suffix=": ").strip()
+    try:
+        idx = int(choice)
+    except ValueError:
+        return options[0]
+    # explicit 1..len bounds — bare `options[idx - 1]` would let "0"/negatives
+    # wrap to the tail of the list via Python's negative indexing
+    if 1 <= idx <= len(options):
+        return options[idx - 1]
+    return options[0]
+
+
+def _device_login(base_url: str) -> OAuthTokens:
+    """Run the device-authorization flow and return the minted tokens.
+
+    Prints the user code + verification URL, opens the browser best-effort, and
+    blocks on the poll loop until the user approves. Exits non-zero on denial,
+    expiry, or interrupt.
+    """
+    endpoints = oauth.resolve_endpoints(base_url)
+    try:
+        device = oauth.request_device_code(endpoints)
+    except oauth.OAuthFlowError as e:
+        _console.print(f"  {ICON_FAIL} [red]Could not start device login[/red]: {e}")
+        raise typer.Exit(1)
+
+    _console.print()
+    _console.print(f"  Enter this code to authorize: [bold {BRAND}]{device.user_code}[/bold {BRAND}]")
+    _console.print(f"  [dim]at[/dim] {device.verification_uri}")
+    _console.print()
+    try:
+        webbrowser.open(device.verification_uri_complete)
+    except Exception:
+        pass  # headless is expected — the URL is printed above
+
+    try:
+        with _console.status("Waiting for approval…", spinner="dots"):
+            tokens = oauth.poll_for_token(endpoints, device)
+    except oauth.AccessDenied:
+        _console.print(f"  {ICON_FAIL} [red]Authorization denied[/red]")
+        raise typer.Exit(1)
+    except (oauth.DeviceCodeExpired, oauth.AuthorizationTimeout):
+        _console.print(f"  {ICON_FAIL} [red]Code expired[/red] — run `honcho init` to try again")
+        raise typer.Exit(1)
+    except oauth.OAuthFlowError as e:
+        _console.print(f"  {ICON_FAIL} [red]Login failed[/red]: {e}")
+        raise typer.Exit(1)
+    except KeyboardInterrupt:
+        _console.print(f"  {ICON_FAIL} [red]Cancelled[/red]")
+        raise typer.Exit(1)
+
+    return OAuthTokens.from_response(
+        tokens,
+        client_id=endpoints.client_id,
+        scope_fallback=endpoints.scope,
+        host=base_url,
+    )
+
+
 def _prompt_api_key(value: str) -> str:
     """Prompt for API key.
 
@@ -206,6 +330,21 @@ def _check_connection(base_url: str, api_key: str) -> None:
 # --------------------------------------------------------------------------- #
 # honcho doctor
 
+def _auth_mode_detail(config: CLIConfig) -> str:
+    """Human summary of which credential the CLI will use."""
+    tokens = config.usable_oauth()
+    if tokens is not None:
+        if tokens.access_valid():
+            secs = max(int(tokens.access_expires_at - time.time()), 0)
+            return f"OAuth device token (expires in {secs // 60}m)"
+        if config.api_key:
+            return "API key (OAuth token expired)"
+        return "OAuth device token (expired — will refresh)"
+    if config.api_key:
+        return "API key"
+    return "missing — run `honcho init`"
+
+
 def doctor(
     json_output: bool = typer.Option(False, "--json", help="Force JSON output"),
 ) -> None:
@@ -230,23 +369,30 @@ def doctor(
         _console.print(f"\n[bold {BRAND}]Honcho Doctor[/bold {BRAND}]\n")
 
     config = get_resolved_config()
+    # Refresh an expired OAuth token if we can; a failure surfaces as a failed
+    # connectivity check below rather than aborting the diagnostic.
+    try:
+        maybe_refresh_token(config)
+    except typer.Exit:
+        pass
+    key = config.resolved_api_key()
+
     _add("Config file", CONFIG_FILE.exists(),
          str(CONFIG_FILE) if CONFIG_FILE.exists() else f"{CONFIG_FILE} not found")
-    _add("API key configured", bool(config.api_key),
-         "set" if config.api_key else "missing — run `honcho init`")
+    _add("Credentials configured", bool(key), _auth_mode_detail(config))
 
-    if config.base_url and config.api_key:
-        _add("API connectivity", *_test_connection(config.base_url, config.api_key))
+    if config.base_url and key:
+        _add("API connectivity", *_test_connection(config.base_url, key))
     else:
-        _add("API connectivity", False, "skipped — no base_url or api_key")
+        _add("API connectivity", False, "skipped — no base_url or credentials")
 
     # Workspace / peer / queue run only when scoped via -w / -p.
     ws_ok, client = False, None
-    if config.workspace_id and config.api_key:
+    if config.workspace_id and key:
         try:
 
 
-            client = Honcho(base_url=config.base_url, api_key=config.api_key, workspace_id=config.workspace_id)
+            client = Honcho(base_url=config.base_url, api_key=key, workspace_id=config.workspace_id)
             client.get_configuration()
             ws_ok = True
             _add("Workspace reachable", True, config.workspace_id)
@@ -280,7 +426,7 @@ def doctor(
         _console.print(f"\n  [{color}]{passed}/{total}[/{color}] checks passed{hint}\n")
 
     # Config file + API connectivity are hard requirements.
-    critical = {"Config file", "API key configured", "API connectivity"}
+    critical = {"Config file", "Credentials configured", "API connectivity"}
     if config.workspace_id:
         critical.add("Workspace reachable")
     if any(not c["ok"] for c in checks if c["check"] in critical):

{honcho_cli-0.1.1 → honcho_cli-0.1.2}/src/honcho_cli/common.py

@@ -12,13 +12,15 @@ no-op if the same flag was already set at an outer level.
 
 from __future__ import annotations
 
+from dataclasses import replace
 from typing import Optional
 
 import typer
 
 from honcho import Honcho
 
-from honcho_cli.config import CLIConfig, get_client_kwargs
+from honcho_cli import oauth
+from honcho_cli.config import CLIConfig, OAuthTokens, get_client_kwargs
 from honcho_cli.output import print_error, set_json_mode
 from honcho_cli.validation import validate_resource_id
 
@@ -50,6 +52,50 @@ def get_resolved_config():
     return config
 
 
+def maybe_refresh_token(config: CLIConfig) -> None:
+    """Refresh an expired OAuth access token in place and persist it.
+
+    No-op when there is no grant for the current host or the token is still
+    valid. A dead grant degrades to the saved apiKey with a warning; exits
+    only when nothing is left to authenticate with.
+    """
+    tokens = config.usable_oauth()
+    if tokens is None or tokens.access_valid():
+        return
+
+    if tokens.refresh_token:
+        endpoints = oauth.resolve_endpoints(config.base_url)
+        if tokens.client_id:
+            endpoints = replace(endpoints, client_id=tokens.client_id)
+        try:
+            refreshed = oauth.refresh_access_token(endpoints, tokens.refresh_token)
+        except oauth.OAuthFlowError:
+            refreshed = None
+        if refreshed is not None:
+            # rotation-safe: persist the (possibly new) refresh token before
+            # it's reused; keep the old one if the server didn't rotate
+            # (refresh_token is optional)
+            config.oauth = OAuthTokens.from_response(
+                refreshed,
+                client_id=tokens.client_id,
+                scope_fallback=tokens.scope,
+                refresh_fallback=tokens.refresh_token,
+                host=tokens.host,
+            )
+            config.save()
+            return
+
+    if config.api_key:
+        typer.echo(
+            "OAuth session expired; using the saved API key. "
+            "Run `honcho init` to log in again.",
+            err=True,
+        )
+        return
+    print_error("SESSION_EXPIRED", "OAuth session expired. Run `honcho init` to log in again.")
+    raise typer.Exit(1)
+
+
 def get_client(*, require_workspace: bool = True):
     """Create a Honcho client from resolved config.
 
@@ -65,6 +111,7 @@ def get_client(*, require_workspace: bool = True):
             "No workspace scoped. Pass --workspace/-w or set HONCHO_WORKSPACE_ID.",
         )
         raise typer.Exit(1)
+    maybe_refresh_token(config)
     return Honcho(**get_client_kwargs(config)), config
 
 

honcho_cli-0.1.2/src/honcho_cli/config.py

@@ -0,0 +1,292 @@
+"""Configuration management for Honcho CLI.
+
+Config stored at ``~/.honcho/config.json`` with env var overrides. The config
+directory defaults to ``~/.honcho`` and can be relocated with `HONCHO_CONFIG_DIR`
+
+The CLI owns these top-level keys in that file:
+
+    environmentUrl  -- Honcho API URL (full URL, e.g. https://api.honcho.dev)
+    oauth           -- OAuth device-grant tokens (accessToken, refreshToken,
+                       accessExpiresAt, clientId, scope, host), written by
+                       device login
+
+``apiKey`` (manual admin JWT) is shared with sibling tools: the CLI writes it
+on paste-key login and reads it as a fallback, but never deletes it. A live
+OAuth token takes precedence over ``apiKey`` for the CLI's own calls.
+
+All other top-level keys (``hosts``, ``sessions``, ``saveMessages``,
+``sessionStrategy``, …) are written by sibling Honcho tools and are
+preserved untouched on save.
+
+Workspace / peer / session scoping is intentionally *not* persisted here —
+pass ``-w`` / ``-p`` / ``-s`` flags or set ``HONCHO_WORKSPACE_ID`` /
+``HONCHO_PEER_ID`` / ``HONCHO_SESSION_ID`` per command instead.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+from dataclasses import dataclass, fields
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from honcho_cli.oauth import TokenResponse
+
+def _config_dir() -> Path:
+    """Config directory: ``$HONCHO_CONFIG_DIR`` if set, else ``~/.honcho``."""
+    override = os.environ.get("HONCHO_CONFIG_DIR")
+    return Path(override).expanduser() if override else Path.home() / ".honcho"
+
+
+CONFIG_DIR = _config_dir()
+CONFIG_FILE = CONFIG_DIR / "config.json"
+
+DEFAULT_BASE_URL = "https://api.honcho.dev"
+
+
+def _redact_token(token: str) -> str:
+    """Show ``***<last4>`` — enough to compare tokens without leaking the body."""
+    if not token:
+        return ""
+    return "***" + token[-4:] if len(token) > 4 else "***"
+
+
+def _coerce_epoch(value: object) -> float:
+    """Parse a persisted epoch-seconds value, treating garbage as expired (0)."""
+    if isinstance(value, (int, float)):
+        return float(value)
+    if isinstance(value, str):
+        try:
+            return float(value)
+        except ValueError:
+            return 0.0
+    return 0.0
+
+# Env var mapping for runtime overrides.
+#
+# Resolution order: flag > env var > config file > default.
+ENV_MAP: dict[str, str] = {
+    "api_key": "HONCHO_API_KEY",
+    "base_url": "HONCHO_BASE_URL",
+    "workspace_id": "HONCHO_WORKSPACE_ID",
+    "peer_id": "HONCHO_PEER_ID",
+    "session_id": "HONCHO_SESSION_ID",
+}
+
+
+@dataclass
+class OAuthTokens:
+    """Device-grant tokens persisted under the config ``oauth`` key."""
+
+    access_token: str = ""
+    refresh_token: str = ""
+    access_expires_at: float = 0.0  # epoch seconds
+    client_id: str = ""
+    scope: str = ""
+    host: str = ""  # base_url the grant was minted against
+
+    def matches_host(self, base_url: str) -> bool:
+        """True when the grant belongs to ``base_url``.
+
+        Tokens are host-scoped — a staging grant must not be sent to prod.
+        Legacy blocks with no recorded host are trusted.
+        """
+        return not self.host or self.host.rstrip("/") == base_url.rstrip("/")
+
+    def access_valid(self, skew: int = 60) -> bool:
+        """True while the access token is present and not within ``skew`` of expiry.
+
+        Checks the expiry timestamp recorded at mint time, not the token
+        itself — the server is the real authority, so a wrong answer here
+        costs at most an extra refresh or a 401.
+        """
+        return bool(self.access_token) and time.time() < self.access_expires_at - skew
+
+    @classmethod
+    def from_response(
+        cls,
+        resp: TokenResponse,
+        *,
+        client_id: str,
+        scope_fallback: str = "",
+        refresh_fallback: str = "",
+        host: str = "",
+    ) -> OAuthTokens:
+        """Build persisted tokens from a token response.
+
+        ``refresh_fallback`` keeps the prior refresh token when the server
+        doesn't rotate one (optional on the refresh grant, RFC 6749 §5.1).
+        """
+        return cls(
+            access_token=resp.access_token,
+            refresh_token=resp.refresh_token or refresh_fallback,
+            access_expires_at=time.time() + resp.expires_in,
+            client_id=client_id,
+            scope=resp.scope or scope_fallback,
+            host=host,
+        )
+
+
+@dataclass
+class CLIConfig:
+    """CLI configuration with layered resolution: flag > env > file > default.
+
+    ``workspace_id`` / ``peer_id`` / ``session_id`` exist on this dataclass so
+    flag/env overrides flow through ``get_client_kwargs()``, but they are
+    never read from or written to the config file — they're per-command.
+    """
+
+    base_url: str = DEFAULT_BASE_URL
+    api_key: str = ""
+    workspace_id: str = ""
+    peer_id: str = ""
+    session_id: str = ""
+    oauth: OAuthTokens | None = None
+
+    def usable_oauth(self) -> OAuthTokens | None:
+        """The OAuth grant, if present and bound to the current host."""
+        if (
+            self.oauth
+            and self.oauth.access_token
+            and self.oauth.matches_host(self.base_url)
+        ):
+            return self.oauth
+        return None
+
+    def resolved_api_key(self) -> str:
+        """The key handed to the SDK: a live OAuth token wins, else apiKey.
+
+        An expired grant loses to a saved apiKey (a dead grant degrades to the
+        shared key) but still wins over nothing, since the server is the final
+        judge.
+        """
+        tokens = self.usable_oauth()
+        if tokens and tokens.access_valid():
+            return tokens.access_token
+        if self.api_key:
+            return self.api_key
+        if tokens:
+            return tokens.access_token
+        return ""
+
+    @classmethod
+    def load(cls) -> CLIConfig:
+        """Load config from file, then overlay env vars."""
+        config = cls()
+
+        if CONFIG_FILE.exists():
+            try:
+                with open(CONFIG_FILE, encoding="utf-8") as f:
+                    data = json.load(f)
+            except (json.JSONDecodeError, OSError):
+                data = {}
+
+            if isinstance(data, dict):
+                url = data.get("environmentUrl")
+                if isinstance(url, str) and url:
+                    config.base_url = url
+                key = data.get("apiKey")
+                if isinstance(key, str):
+                    config.api_key = key
+                oauth = data.get("oauth")
+                if isinstance(oauth, dict) and oauth.get("accessToken"):
+                    config.oauth = OAuthTokens(
+                        access_token=str(oauth.get("accessToken", "")),
+                        refresh_token=str(oauth.get("refreshToken", "")),
+                        access_expires_at=_coerce_epoch(oauth.get("accessExpiresAt")),
+                        client_id=str(oauth.get("clientId", "")),
+                        scope=str(oauth.get("scope", "")),
+                        host=str(oauth.get("host", "")),
+                    )
+
+        for fld_name, env_var in ENV_MAP.items():
+            val = os.environ.get(env_var)
+            if val:
+                setattr(config, fld_name, val)
+            elif val == "":
+                # SDK reads these env vars directly and crashes on empty
+                # strings with a Pydantic ValidationError. Drop them so the
+                # SDK falls back to kwargs / defaults.
+                os.environ.pop(env_var, None)
+
+        return config
+
+    def save(self) -> None:
+        """Write ``environmentUrl`` + credentials to config.json.
+
+        Preserves unrelated top-level keys (``hosts``, ``sessions``,
+        ``saveMessages``, ``sessionStrategy``, …) that other tools write.
+        ``apiKey`` is written when set but never removed — sibling tools read
+        it. The ``oauth`` block is CLI-owned and dropped when empty.
+        """
+        CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+
+        data: dict = {}
+        if CONFIG_FILE.exists():
+            try:
+                with open(CONFIG_FILE, encoding="utf-8") as f:
+                    loaded = json.load(f)
+                if isinstance(loaded, dict):
+                    data = loaded
+            except (json.JSONDecodeError, OSError):
+                data = {}
+
+        data["environmentUrl"] = self.base_url
+        if self.api_key:
+            data["apiKey"] = self.api_key
+
+        if self.oauth and self.oauth.access_token:
+            data["oauth"] = {
+                "accessToken": self.oauth.access_token,
+                "refreshToken": self.oauth.refresh_token,
+                "accessExpiresAt": self.oauth.access_expires_at,
+                "clientId": self.oauth.client_id,
+                "scope": self.oauth.scope,
+                "host": self.oauth.host,
+            }
+        else:
+            data.pop("oauth", None)
+
+        CONFIG_FILE.write_text(json.dumps(data, indent=2) + "\n")
+        # API key in plaintext — restrict to the owner on multi-user hosts.
+        try:
+            os.chmod(CONFIG_FILE, 0o600)
+        except OSError:
+            pass
+
+    def redacted(self) -> dict[str, str]:
+        """Return config dict with api_key redacted.
+
+        Only includes fields that have a value set — per-command fields
+        (workspace_id, peer_id, session_id) are omitted when empty.
+        """
+        result: dict[str, str] = {}
+        for fld in fields(self):
+            val = getattr(self, fld.name)
+            if not val:
+                continue
+            if fld.name == "api_key":
+                # Show ``***<last4>`` only — enough to compare keys without
+                # leaking the header or body of the JWT.
+                result[fld.name] = _redact_token(val)
+            elif fld.name == "oauth":
+                result[fld.name] = _redact_token(val.access_token)
+            else:
+                result[fld.name] = val
+        return result
+
+
+def get_client_kwargs(config: CLIConfig) -> dict:
+    """Build kwargs for Honcho client from config."""
+    kwargs: dict = {}
+    if config.base_url:
+        kwargs["base_url"] = config.base_url
+    api_key = config.resolved_api_key()
+    if api_key:
+        kwargs["api_key"] = api_key
+    if config.workspace_id:
+        kwargs["workspace_id"] = config.workspace_id
+    return kwargs