langgraph-api 0.15.0.dev2__tar.gz → 0.15.0.dev3__tar.gz

{langgraph_api-0.15.0.dev2 → langgraph_api-0.15.0.dev3}/Makefile

@@ -48,6 +48,7 @@ BG_JOB_TIMEOUT_SECS ?= 86400
 BG_JOB_ISOLATED_LOOPS ?= false
 CRON_SCHEDULER_SLEEP_TIME ?= 0
 RELOAD_ARGS ?= --reload --reload-dir langgraph_api --reload-dir ../runtime_inmem
+LANGGRAPH_AUTH_LANGSMITH ?= {"path": "tests/graphs/jwt_auth.py:auth", "allow_langsmith_api_keys": true}
 
 ifdef CI
 RELOAD_ARGS :=
@@ -166,6 +167,14 @@ test-auth-fastapi-jwt--after-custom-middleware--custom-route-auth:
 test-auth-watch:
 	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_AUTH='{"path": "./tests/graphs/fastapi_jwt_auth.py:auth"}' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run ptw . -- -x -vv --ff --capture=no $(AUTH_TEST)
 
+test-auth-langsmith-api-keys:
+	LANGGRAPH_RUNTIME_EDITION=inmem \
+	LANGGRAPH_AUTH='$(LANGGRAPH_AUTH_LANGSMITH)' \
+	REDIS_URI=_FAKE \
+	DATABASE_URI=:memory: \
+	MIGRATIONS_PATH=__inmem__ \
+	uv run pytest -v tests/integration_tests/test_langsmith_parallel_auth.py
+
 # dev commands
 LANGGRAPH_DISABLE_FILE_PERSISTENCE ?= true
 LANGSMITH_TRACING ?= false
@@ -223,6 +232,8 @@ start-encrypt:
 		--no-access-log
 
 
+LANGGRAPH_AUTH ?= {"path": "tests/graphs/jwt_auth.py:auth"}
+
 start-auth-jwt:
 	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_HTTP='$(HTTP_CONFIG)' \
 	LANGGRAPH_AES_KEY='$(LANGGRAPH_AES_KEY)' \
@@ -230,7 +241,7 @@ start-auth-jwt:
 	LANGSERVE_GRAPHS=$(LANGSERVE_GRAPHS_AUTH) \
 	LANGGRAPH_STORE='$(STORE_CONFIG)' \
 	LANGGRAPH_CHECKPOINTER='$(CHECKPOINTER_CONFIG)' \
-	LANGGRAPH_AUTH='{"path": "tests/graphs/jwt_auth.py:auth"}' \
+	LANGGRAPH_AUTH='$(LANGGRAPH_AUTH)' \
 	LANGSMITH_LANGGRAPH_API_VARIANT=test \
 	REDIS_URI=fake \
 	DATABASE_URI=:memory: \
@@ -258,6 +269,13 @@ start-auth-fastapi-jwt:
 		$(RELOAD_ARGS) \
 		--no-access-log
 
+start-auth-langsmith-api-keys:
+	LANGGRAPH_AUTH_TYPE=langsmith \
+	LANGSMITH_AUTH_ENDPOINT=http://localhost:9124 \
+	LANGSMITH_TENANT_ID=8a1f2c4e-5b6d-4f70-9a3b-2c1d0e4f5a6b \
+	$(MAKE) start-auth-jwt \
+		LANGGRAPH_AUTH='$(LANGGRAPH_AUTH_LANGSMITH)'
+
 define RUN_FASTAPI_JWT_MW_ORDERING
 	LANGGRAPH_RUNTIME_EDITION=inmem \
 	LANGGRAPH_HTTP='{"app": "./tests/graphs/fastapi_jwt_middleware_ordering.py:app", "middleware_order": "$(1)", "enable_custom_route_auth": $(2)}' \

{langgraph_api-0.15.0.dev2 → langgraph_api-0.15.0.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langgraph-api
-Version: 0.15.0.dev2
+Version: 0.15.0.dev3
 Author-email: Will Fu-Hinthorn <will@langchain.dev>, Josh Rogers <josh@langchain.dev>, Parker Rule <parker@langchain.dev>
 License: Elastic-2.0
 License-File: LICENSE
@@ -28,7 +28,7 @@ Requires-Dist: orjson>=3.9.7
 Requires-Dist: prometheus-client>=0.0.1
 Requires-Dist: protobuf<7.0.0,>=6.32.1
 Requires-Dist: pyjwt>=2.13.0
-Requires-Dist: sse-starlette<3.4.0,>=2.1.3
+Requires-Dist: sse-starlette<4.0.0,>=2.1.3
 Requires-Dist: starlette>=1.3.1
 Requires-Dist: structlog<26,>=24.1.0
 Requires-Dist: tenacity>=8.0.0

{langgraph_api-0.15.0.dev2 → langgraph_api-0.15.0.dev3}/constraints.txt

@@ -10,7 +10,7 @@ orjson>=3.9.7
 httpx>=0.25.0
 tenacity>=8.0.0
 uvicorn>=0.26.0
-sse-starlette>=2.1.3,<3.4.0
+sse-starlette>=2.1.3,<4.0.0
 uvloop>=0.18.0
 httptools>=0.5.0
 jsonschema-rs>=0.20.0

langgraph_api-0.15.0.dev3/langgraph_api/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.15.0.dev3"

{langgraph_api-0.15.0.dev2 → langgraph_api-0.15.0.dev3}/langgraph_api/auth/custom.py

@@ -147,6 +147,7 @@ class CustomAuthBackend(AuthenticationBackend):
             Awaitable[tuple[list[str], Any]],
         ],
         disable_studio_auth: bool = False,
+        allow_langsmith_api_keys: bool | None = None,
     ):
         if not inspect.iscoroutinefunction(fn):
             self.fn = functools.partial(run_in_threadpool, fn)
@@ -157,6 +158,7 @@ class CustomAuthBackend(AuthenticationBackend):
             if fn
             else None
         )
+        self.allow_langsmith_api_keys = allow_langsmith_api_keys
         self.ls_auth = None
         if not disable_studio_auth:
             if LANGGRAPH_AUTH_TYPE == "langsmith":
@@ -172,6 +174,7 @@ class CustomAuthBackend(AuthenticationBackend):
         return (
             f"CustomAuthBackend(fn={self.fn}, "
             f"ls_auth={self.ls_auth}, "
+            f"allow_langsmith_api_keys={self.allow_langsmith_api_keys}, "
             f"param_names={self._param_names}"
             ")"
         )
@@ -179,11 +182,29 @@ class CustomAuthBackend(AuthenticationBackend):
     async def authenticate(
         self, conn: HTTPConnection
     ) -> tuple[AuthCredentials, BaseUser] | None:
-        if self.ls_auth is not None and (
-            (auth_scheme := conn.headers.get("x-auth-scheme"))
-            and auth_scheme == "langsmith"
-        ):
-            return await self.ls_auth.authenticate(conn)
+        ls_auth = self.ls_auth
+        authorization = conn.headers.get("authorization")
+        use_langsmith = ls_auth is not None and (
+            # Studio auth uses the "langsmith" scheme.
+            conn.headers.get("x-auth-scheme") == "langsmith"
+            # LangSmith API keys travel on the Authorization header.
+            or (
+                bool(self.allow_langsmith_api_keys)
+                and (authorization is None or authorization.strip() == "")
+            )
+        )
+        if use_langsmith:
+            result = await ls_auth.authenticate(conn)
+            handler = "langsmith"
+        else:
+            result = await self._authenticate_custom(conn)
+            handler = "custom"
+        await logger.ainfo("Resolved authentication handler", auth_handler=handler)
+        return result
+
+    async def _authenticate_custom(
+        self, conn: HTTPConnection
+    ) -> tuple[AuthCredentials, BaseUser] | None:
         if self.fn is None:
             return None
         try:
@@ -227,11 +248,13 @@ def _get_custom_auth_middleware(
     config: str | dict,
 ) -> AuthenticationBackend:
     disable_studio_auth = False
+    allow_langsmith_api_keys: bool | None = None
     if isinstance(config, str):
         path: str | None = config
     else:
         path = config.get("path")
         disable_studio_auth = config.get("disable_studio_auth", disable_studio_auth)
+        allow_langsmith_api_keys = config.get("allow_langsmith_api_keys")
 
     auth_instance = _get_auth_instance(path)
     if auth_instance is None:
@@ -246,7 +269,10 @@ def _get_custom_auth_middleware(
     if auth_instance == "js":
         from langgraph_api.js.remote import CustomJsAuthBackend  # noqa: PLC0415
 
-        return CustomJsAuthBackend(disable_studio_auth=disable_studio_auth)
+        return CustomJsAuthBackend(
+            disable_studio_auth=disable_studio_auth,
+            allow_langsmith_api_keys=allow_langsmith_api_keys,
+        )
 
     if auth_instance._authenticate_handler is None:
         raise ValueError(
@@ -268,6 +294,7 @@ def _get_custom_auth_middleware(
     result = CustomAuthBackend(
         auth_instance._authenticate_handler,
         disable_studio_auth,
+        allow_langsmith_api_keys,
     )
     logger.info(f"Loaded custom auth middleware: {result!s}")
     return result

{langgraph_api-0.15.0.dev2 → langgraph_api-0.15.0.dev3}/langgraph_api/config/schemas.py

@@ -339,6 +339,22 @@ class AuthConfig(TypedDict, total=False):
     """Path to the authentication function in a Python file."""
     disable_studio_auth: bool
     """Whether to disable auth when connecting from the LangSmith Studio."""
+    allow_langsmith_api_keys: bool
+    """Run LangSmith API-key auth alongside custom auth.
+
+    Omitted or false (default): custom auth handles every request except
+    Studio (``x-auth-scheme: langsmith``).
+
+    True: requests with an ``Authorization`` header go to custom auth; all
+    others go to LangSmith (API keys use ``x-api-key``, not
+    ``Authorization``). No retry if the chosen handler fails.
+
+    LangSmith-authenticated users are ``StudioUser``. Custom ``@auth.on``
+    resource handlers still run.
+
+    Requires ``LANGGRAPH_AUTH_TYPE=langsmith`` and ``disable_studio_auth``
+    unset/false.
+    """
     openapi: SecurityConfig
     """The schema to use for updating the openapi spec.
 

{langgraph_api-0.15.0.dev2 → langgraph_api-0.15.0.dev3}/langgraph_api/graph.py

@@ -645,6 +645,8 @@ async def collect_graphs_from_env(register: bool = False) -> None:
 
         for spec in js_specs:
             graph = RemotePregel(graph_id=spec.id)
+            if register and USE_RUNTIME_CONTEXT_API:
+                await graph.prefetch_context_jsonschema()
             if register:
                 await register_graph(
                     spec.id, graph, spec.config, description=spec.description

{langgraph_api-0.15.0.dev2 → langgraph_api-0.15.0.dev3}/langgraph_api/js/client.mts

@@ -647,6 +647,7 @@ const StreamEventsPayload = z.object({
     .union([z.string(), z.array(z.string())])
     .optional(),
   config: RunnableConfigSchema.nullish(),
+  context: z.record(z.unknown()).nullish(),
   interrupt_before: z.union([z.array(z.string()), z.literal("*")]).nullish(),
   interrupt_after: z.union([z.array(z.string()), z.literal("*")]).nullish(),
   subgraphs: z.boolean().optional(),
@@ -683,7 +684,10 @@ async function* streamEventsRequest(
   rawPayload: z.infer<typeof StreamEventsPayload>,
 ) {
   const { graph_id: graphId, ...payload } = rawPayload;
-  const config = getRunnableConfig(payload.config);
+  const config = {
+    ...getRunnableConfig(payload.config),
+    context: payload.context ?? undefined,
+  };
   const graph = await getGraph(graphId, config, payload.graph_name);
   const input = reviveCommand(payload.command) ?? payload.input;
   // TODO Check if it's a remote graph and don't set in that case
@@ -1223,6 +1227,7 @@ async function main() {
     .object({
       path: z.string().optional(),
       disable_studio_auth: z.boolean().optional(),
+      allow_langsmith_api_keys: z.boolean().optional(),
     })
     .parse(JSON.parse(process.env.LANGGRAPH_AUTH ?? "{}"));
 

{langgraph_api-0.15.0.dev2 → langgraph_api-0.15.0.dev3}/langgraph_api/js/remote.py

@@ -95,6 +95,9 @@ if (port := int(os.getenv("PORT", "8080"))) and port in (GRAPH_PORT, REMOTE_PORT
         f"PORT={port} is a reserved port for the JS worker. Please choose a different port."
     )
 
+# Per-graph context schema, prefetched at startup so get_context_jsonschema stays sync.
+_context_jsonschema_cache: dict[str, dict[str, Any] | None] = {}
+
 _client = httpx.AsyncClient(
     base_url=f"http://localhost:{GRAPH_PORT}",
     # Temporarily allow longer idle periods between sidecar response chunks.
@@ -291,7 +294,34 @@ class RemotePregel(BaseRemotePregel):
             yield event
 
     async def fetch_state_schema(self):
-        return await _client_invoke("getSchema", {"graph_id": self.graph_id})
+        return await _client_invoke(
+            "getSchema",
+            {
+                "graph_id": self.graph_id,
+                "graph_config": self._inject_auth_to_config(self.config),
+            },
+        )
+
+    async def _refresh_context_jsonschema(self) -> None:
+        """Fetch and cache the context schema only when the request succeeds."""
+        try:
+            schema = await self.fetch_state_schema()
+            _context_jsonschema_cache[self.graph_id] = schema.get("config")
+        except Exception as e:
+            await logger.adebug(
+                f"Failed to fetch context schema for JS graph {self.graph_id}; "
+                f"its context will not be filtered this attempt: {e}",
+                exc_info=e,
+            )
+
+    async def prefetch_context_jsonschema(self) -> None:
+        await self._refresh_context_jsonschema()
+
+    async def aget_context_jsonschema(self) -> dict:
+        """Fetch the context schema under request authentication and cache it on success."""
+        if self.graph_id not in _context_jsonschema_cache:
+            await self._refresh_context_jsonschema()
+        return _context_jsonschema_cache.get(self.graph_id) or {}
 
     async def fetch_graph(
         self,
@@ -468,7 +498,7 @@ class RemotePregel(BaseRemotePregel):
         raise NotImplementedError()
 
     def get_context_jsonschema(self) -> dict:
-        raise NotImplementedError()
+        return _context_jsonschema_cache.get(self.graph_id) or {}
 
     async def invoke(self, input: Any, config: RunnableConfig | None = None):
         raise NotImplementedError()
@@ -1077,9 +1107,14 @@ async def js_healthcheck():
 class CustomJsAuthBackend(AuthenticationBackend):
     ls_auth: AuthenticationBackend | None
 
-    def __init__(self, disable_studio_auth: bool = False):
+    def __init__(
+        self,
+        disable_studio_auth: bool = False,
+        allow_langsmith_api_keys: bool | None = None,
+    ):
         from langgraph_api.utils.cache import LRUCache  # noqa: PLC0415
 
+        self.allow_langsmith_api_keys = allow_langsmith_api_keys
         self.ls_auth = None
         if not disable_studio_auth and LANGGRAPH_AUTH_TYPE == "langsmith":
             from langgraph_api.auth.langsmith.backend import (  # noqa: PLC0415
@@ -1106,12 +1141,29 @@ class CustomJsAuthBackend(AuthenticationBackend):
     async def authenticate(
         self, conn: HTTPConnection
     ) -> tuple[AuthCredentials, BaseUser] | None:
-        if self.ls_auth is not None and (
-            (auth_scheme := conn.headers.get("x-auth-scheme"))
-            and auth_scheme == "langsmith"
-        ):
-            return await self.ls_auth.authenticate(conn)
+        ls_auth = self.ls_auth
+        authorization = conn.headers.get("authorization")
+        use_langsmith = ls_auth is not None and (
+            # Studio auth uses the "langsmith" scheme.
+            conn.headers.get("x-auth-scheme") == "langsmith"
+            # LangSmith API keys travel on the Authorization header.
+            or (
+                bool(self.allow_langsmith_api_keys)
+                and (authorization is None or authorization.strip() == "")
+            )
+        )
+        if use_langsmith:
+            result = await ls_auth.authenticate(conn)
+            handler = "langsmith"
+        else:
+            result = await self._authenticate_js(conn)
+            handler = "custom"
+        await logger.ainfo("Resolved authentication handler", auth_handler=handler)
+        return result
 
+    async def _authenticate_js(
+        self, conn: HTTPConnection
+    ) -> tuple[AuthCredentials, BaseUser] | None:
         headers = dict(conn.headers)
         # need to remove content-length to prevent confusing the HTTP client
         headers.pop("content-length", None)

{langgraph_api-0.15.0.dev2 → langgraph_api-0.15.0.dev3}/langgraph_api/models/run.py

@@ -253,9 +253,10 @@ async def create_valid_run(
                 ),
             )
 
-    # Keep config and context in sync for user provided params
+    # Mark context-provided runs so stream.py can filter their mirrored configurable values safely.
     if context:
         configurable = context.copy()
+        configurable["__context_provided__"] = True
         config["configurable"] = configurable
     else:
         context = configurable.copy()

{langgraph_api-0.15.0.dev2 → langgraph_api-0.15.0.dev3}/langgraph_api/stream.py

@@ -176,6 +176,8 @@ async def astream_state(
     context = kwargs.pop("context", None)
     config = cast("RunnableConfig", kwargs.pop("config"))
     configurable = config["configurable"]
+    # Remove the internal marker before the graph receives or persists the configuration.
+    context_provided_by_caller = configurable.pop("__context_provided__", False)
     stack = AsyncExitStack()
     graph = await stack.enter_async_context(
         get_graph(
@@ -191,11 +193,21 @@ async def astream_state(
         )
     )
 
-    # Filter context parameters based on context schema if available
-    if context and USE_RUNTIME_CONTEXT_API and not isinstance(graph, BaseRemotePregel):
+    # Filter context with the request's authentication context when the graph is remote.
+    if context and USE_RUNTIME_CONTEXT_API:
         try:
-            context_schema = graph.get_context_jsonschema()
-            context = await _filter_context_by_schema(context, context_schema)
+            context_schema = (
+                await graph.aget_context_jsonschema()
+                if isinstance(graph, BaseRemotePregel)
+                else graph.get_context_jsonschema()
+            )
+            filtered_context = await _filter_context_by_schema(context, context_schema)
+            # Remove dropped keys from the mirrored configurable only when the caller supplied context.
+            if context_provided_by_caller:
+                for dropped_key in context.keys() - filtered_context.keys():
+                    if configurable.get(dropped_key) == context[dropped_key]:
+                        configurable.pop(dropped_key, None)
+            context = filtered_context
         except Exception as e:
             await logger.adebug(
                 f"Failed to get context schema for filtering: {e}", exc_info=e

{langgraph_api-0.15.0.dev2 → langgraph_api-0.15.0.dev3}/langgraph_api/validation.py

@@ -30,6 +30,7 @@ RESERVED_CONFIGURABLE_KEYS = (
     "__otel_tracestate__",
     "__dd_trace_headers__",
     "__pregel_node_finished",
+    "__context_provided__",
 )
 RESERVED_METADATA_KEYS = (
     "thread_id",

{langgraph_api-0.15.0.dev2 → langgraph_api-0.15.0.dev3}/pyproject.toml

@@ -15,7 +15,7 @@ license = { text = "Elastic-2.0" }
 requires-python = ">=3.11"
 readme = "README.md"
 dependencies = [
-    "sse-starlette>=2.1.3,<3.4.0",
+    "sse-starlette>=2.1.3,<4.0.0",
     "starlette>=1.3.1",
     "watchfiles>=0.13",
     "uvloop>=0.18.0; platform_system != 'Windows'",

{langgraph_api-0.15.0.dev2 → langgraph_api-0.15.0.dev3}/uv.lock

@@ -786,7 +786,7 @@ requires-dist = [
     { name = "prometheus-client", specifier = ">=0.0.1" },
     { name = "protobuf", specifier = ">=6.32.1,<7.0.0" },
     { name = "pyjwt", specifier = ">=2.13.0" },
-    { name = "sse-starlette", specifier = ">=2.1.3,<3.4.0" },
+    { name = "sse-starlette", specifier = ">=2.1.3,<4.0.0" },
     { name = "starlette", specifier = ">=1.3.1" },
     { name = "structlog", specifier = ">=24.1.0,<26" },
     { name = "tenacity", specifier = ">=8.0.0" },
@@ -1783,15 +1783,15 @@ wheels = [
 
 [[package]]
 name = "sse-starlette"
-version = "3.3.4"
+version = "3.4.8"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
     { name = "starlette" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/26/8c/f9290339ef6d79badbc010f067cd769d6601ec11a57d78569c683fb4dd87/sse_starlette-3.3.4.tar.gz", hash = "sha256:aaf92fc067af8a5427192895ac028e947b484ac01edbc3caf00e7e7137c7bef1", size = 32427, upload-time = "2026-03-29T09:00:23.307Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f8/00/b42a44342a054d58cb1115d7c8aa9cb4290dd9442f9c1b91a4b8173dba22/sse_starlette-3.4.8.tar.gz", hash = "sha256:ed89ffbb75cbf78a5fe2f2109cd584792ee7f9dfac96f791db546df8f15f3f9c", size = 32548, upload-time = "2026-08-05T11:19:49.982Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f8/7f/3de5402f39890ac5660b86bcf5c03f9d855dad5c4ed764866d7b592b46fd/sse_starlette-3.3.4-py3-none-any.whl", hash = "sha256:84bb06e58939a8b38d8341f1bc9792f06c2b53f48c608dd207582b664fc8f3c1", size = 14330, upload-time = "2026-03-29T09:00:21.846Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/3a/764912c58293d95b6dcdf4cc255f9d10de310580ced547b082eb9d72018c/sse_starlette-3.4.8-py3-none-any.whl", hash = "sha256:6e82314c786709a3cd9520f2285cf9fff90e181e598e8a357b0cf80f66afba0d", size = 16516, upload-time = "2026-08-05T11:19:48.748Z" },
 ]
 
 [[package]]

langgraph_api-0.15.0.dev2/langgraph_api/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.15.0.dev2"