modal 1.6.3.dev11__tar.gz → 1.6.3.dev12__tar.gz

{modal-1.6.3.dev11 → modal-1.6.3.dev12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modal
-Version: 1.6.3.dev11
+Version: 1.6.3.dev12
 Summary: Python client library for Modal
 Author-email: Modal Labs <support@modal.com>
 License-Expression: Apache-2.0
@@ -23,7 +23,7 @@ Requires-Dist: grpclib<0.4.10,>=0.4.7; python_version < "3.14"
 Requires-Dist: grpclib<0.4.10,>=0.4.9; python_version >= "3.14"
 Requires-Dist: protobuf!=4.24.0,<8.0,>=3.19
 Requires-Dist: rich>=12.0.0
-Requires-Dist: synchronicity~=0.12.6
+Requires-Dist: synchronicity~=0.12.7
 Requires-Dist: toml
 Requires-Dist: types-certifi
 Requires-Dist: types-toml
@@ -33,6 +33,8 @@ Requires-Dist: typing_extensions>=4.14; python_version >= "3.15"
 Provides-Extra: api-proxy-support
 Requires-Dist: python-socks[asyncio]>=2.5; extra == "api-proxy-support"
 Requires-Dist: aiohttp-socks>=0.8; extra == "api-proxy-support"
+Provides-Extra: oauth
+Requires-Dist: pyjwt[crypto]>=2.7; extra == "oauth"
 Dynamic: license-file
 
 # Modal Python SDK

{modal-1.6.3.dev11 → modal-1.6.3.dev12}/modal/_image.py

@@ -445,6 +445,40 @@ def _create_context_mount_function(
         return auto_created_context_mount_fn
 
 
+_REGISTRY_AUTH_KEY_SETS: dict["api_pb2.RegistryAuthType.ValueType", list[set[str]]] = {
+    api_pb2.REGISTRY_AUTH_TYPE_AWS: [
+        {"AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"},
+        {"AWS_ROLE_ARN", "AWS_REGION"},
+    ],
+    api_pb2.REGISTRY_AUTH_TYPE_GCP: [{"SERVICE_ACCOUNT_JSON"}],
+    api_pb2.REGISTRY_AUTH_TYPE_STATIC_CREDS: [{"REGISTRY_USERNAME", "REGISTRY_PASSWORD"}],
+}
+
+_REGISTRY_AUTH_NAMES = {
+    api_pb2.REGISTRY_AUTH_TYPE_AWS: "AWS",
+    api_pb2.REGISTRY_AUTH_TYPE_GCP: "GCP",
+    api_pb2.REGISTRY_AUTH_TYPE_STATIC_CREDS: "username and password",
+}
+
+_REGISTRY_SECRET_KEYS_HELP = (
+    "Registry Secret must include exactly one of: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_REGION "
+    "(or AWS_ROLE_ARN and AWS_REGION) for AWS ECR; SERVICE_ACCOUNT_JSON for GCP Artifact Registry; "
+    "or REGISTRY_USERNAME and REGISTRY_PASSWORD for other registries."
+)
+
+
+def _infer_registry_auth_type(keys: set[str]) -> "api_pb2.RegistryAuthType.ValueType":
+    matches = [auth for auth, key_sets in _REGISTRY_AUTH_KEY_SETS.items() if any(ks <= keys for ks in key_sets)]
+    if not matches:
+        raise InvalidError(f"{_REGISTRY_SECRET_KEYS_HELP} Found keys: {', '.join(sorted(keys)) or 'none'}.")
+    if len(matches) > 1:
+        names = ", ".join(_REGISTRY_AUTH_NAMES[auth] for auth in matches)
+        raise InvalidError(
+            f"Registry Secret has keys for more than one kind of authentication ({names}). {_REGISTRY_SECRET_KEYS_HELP}"
+        )
+    return matches[0]
+
+
 class _ImageRegistryConfig:
     """mdmd:hidden"""
 
@@ -453,13 +487,21 @@ class _ImageRegistryConfig:
         # TODO: change to _PUBLIC after worker starts handling it.
         registry_auth_type: "api_pb2.RegistryAuthType.ValueType" = api_pb2.REGISTRY_AUTH_TYPE_UNSPECIFIED,
         secret: _Secret | None = None,
+        *,
+        infer_auth_type: bool = False,
     ):
         self.registry_auth_type = registry_auth_type
         self.secret = secret
-
-    def get_proto(self) -> api_pb2.ImageRegistryConfig:
+        self.infer_auth_type = infer_auth_type
+
+    async def get_proto(self) -> api_pb2.ImageRegistryConfig:
+        registry_auth_type = self.registry_auth_type
+        if self.infer_auth_type and self.secret:
+            # The Secret is an Image dependency, so it's hydrated by now and its keys are cached
+            keys = await self.secret._get_keys()
+            registry_auth_type = _infer_registry_auth_type(keys)
         return api_pb2.ImageRegistryConfig(
-            registry_auth_type=self.registry_auth_type,
+            registry_auth_type=registry_auth_type,
             secret_id=(self.secret.object_id if self.secret else ""),
         )
 
@@ -762,7 +804,7 @@ class _Image(_Object, type_prefix="im"):
                 secret_ids=[secret.object_id for secret in secrets],
                 context_mount_id=(context_mount.object_id if context_mount else ""),
                 gpu_config=gpu_config,
-                image_registry_config=image_registry_config.get_proto(),
+                image_registry_config=await image_registry_config.get_proto(),
                 runtime=config.get("function_runtime"),
                 runtime_debug=config.get("function_runtime_debug"),
                 build_function=_build_function,
@@ -2255,16 +2297,21 @@ class _Image(_Object, type_prefix="im"):
         remaining commands run. This might be useful if you want a custom Python installation or to
         set a `SHELL`. Prefer `run_commands()` when possible though.
 
-        To authenticate against a private registry with static credentials, you must set the `secret` parameter to
-        a `modal.Secret` containing a username (`REGISTRY_USERNAME`) and
-        an access token or password (`REGISTRY_PASSWORD`).
+        To pull from a private registry, set the `secret` parameter to a `modal.Secret` holding
+        registry credentials. The kind of authentication follows from the keys in the Secret:
+
+        - AWS ECR: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` and `AWS_REGION` (optionally `AWS_SESSION_TOKEN`),
+          or `AWS_ROLE_ARN` and `AWS_REGION` to assume a role with [OIDC](https://modal.com/docs/guide/oidc-integration).
+          See `Image.from_aws_ecr()` for details.
+        - GCP Artifact Registry: `SERVICE_ACCOUNT_JSON`, holding the service account key's JSON.
+          See `Image.from_gcp_artifact_registry()` for details.
+        - Other registries: a username (`REGISTRY_USERNAME`) and an access token or password (`REGISTRY_PASSWORD`).
 
-        To authenticate against private registries with credentials from a cloud provider,
-        use `Image.from_gcp_artifact_registry()` or `Image.from_aws_ecr()`.
+        The Secret must have the keys for exactly one of these; otherwise an error is raised.
 
         Args:
             tag: Registry image reference (e.g. ``python:3.11-slim``).
-            secret: Optional secret for static registry credentials.
+            secret: Optional Secret with registry credentials; its keys determine the kind of authentication.
             setup_dockerfile_commands: Extra Dockerfile lines run after ``FROM`` during base setup.
             force_build: If True, skip cached image builds.
             add_python: Optional standalone Python series to inject when the base image lacks Python.
@@ -2278,6 +2325,10 @@ class _Image(_Object, type_prefix="im"):
             modal.Image.from_registry("python:3.11-slim-bookworm")
             modal.Image.from_registry("ubuntu:22.04", add_python="3.11")
             modal.Image.from_registry("nvcr.io/nvidia/pytorch:22.12-py3")
+            modal.Image.from_registry(
+                "ghcr.io/my-org/my-image:latest",
+                secret=modal.Secret.from_name("my-registry-secret"),
+            )
             ```
         """
 
@@ -2292,7 +2343,7 @@ class _Image(_Object, type_prefix="im"):
             )
 
         if "image_registry_config" not in kwargs and secret is not None:
-            kwargs["image_registry_config"] = _ImageRegistryConfig(api_pb2.REGISTRY_AUTH_TYPE_STATIC_CREDS, secret)
+            kwargs["image_registry_config"] = _ImageRegistryConfig(secret=secret, infer_auth_type=True)
 
         def build_dockerfile(version: ImageBuilderVersion) -> DockerfileSpec:
             commands = _Image._registry_setup_commands(tag, version, setup_dockerfile_commands, add_python)
@@ -2562,10 +2613,6 @@ class _Image(_Object, type_prefix="im"):
                 force_build=force_build,
             )
 
-        # --- Now add in the modal dependencies, and, optionally a Python distribution
-        # This happening in two steps is probably a vestigial consequence of previous limitations,
-        # but it will be difficult to merge them without forcing rebuilds of images.
-
         def add_python_mount(builder_version: ImageBuilderVersion) -> _Mount | None:
             return (
                 _Mount.from_name(
@@ -2606,9 +2653,12 @@ class _Image(_Object, type_prefix="im"):
             # Dockerfiles the split could change (see splittable_from_line_index) stay in one layer.
             from_index = splittable_from_line_index(dockerfile_lines) if builder_version > "2025.06" else None
             if from_index is None:
-                image = python_image(dockerfile_image(dockerfile_lines))
+                image = dockerfile_image(dockerfile_lines)
             else:
-                from_lines = dockerfile_lines[: from_index + 1]
+                # Drop the lines above FROM so Dockerfiles that differ only in header comments or blank lines
+                # share the cached image. Those lines can only be comments or blank lines, since
+                # splittable_from_line_index rejects parser directives.
+                from_lines = [dockerfile_lines[from_index]]
                 from_image = _Image._from_args(
                     dockerfile_function=lambda version: DockerfileSpec(commands=from_lines, context_files={}),
                     force_build=force_build,
@@ -2616,9 +2666,14 @@ class _Image(_Object, type_prefix="im"):
                 rest = dockerfile_lines[from_index + 1 :]
                 rest_is_empty = all(not line.strip() or line.strip().startswith("#") for line in rest)
                 if rest_is_empty:
-                    image = python_image(from_image)
+                    image = from_image
                 else:
-                    image = python_image(dockerfile_image(["FROM base", *rest], base_images={"base": from_image}))
+                    image = dockerfile_image(["FROM base", *rest], base_images={"base": from_image})
+            if add_python or builder_version <= "2025.06":
+                # Before 2025.06 we always created a python_image() layer because it's where we installed the
+                # client dependencies. From 2025.06, we no longer install client dependencies in base layers,
+                # so this was a no-op layer when add_python= is not used. Skip it on later image builders.
+                image = python_image(image)
             await resolver.load(image, load_context)
             self._hydrate_from_other(image)
             self._serve_mounts = image._serve_mounts

{modal-1.6.3.dev11 → modal-1.6.3.dev12}/modal/_utils/grpc_utils.py

@@ -9,7 +9,7 @@ import time
 import typing
 import urllib.parse
 import uuid
-from collections.abc import AsyncIterator, Sequence
+from collections.abc import AsyncIterator, Callable, Mapping, Sequence
 from dataclasses import dataclass, field
 from functools import cache
 from typing import Any, Optional, TypeVar, Union
@@ -42,6 +42,7 @@ from .logger import logger
 
 RequestType = TypeVar("RequestType", bound=Message)
 ResponseType = TypeVar("ResponseType", bound=Message)
+MetadataProvider = Callable[[], Mapping[str, str]]
 
 if typing.TYPE_CHECKING:
     import modal._grpc_client
@@ -224,17 +225,29 @@ class ConnectionManager:
     should share the same connection.
     """
 
-    def __init__(self, client: "modal.client._Client", metadata: dict[str, str] = {}):
+    def __init__(
+        self,
+        client: "modal.client._Client",
+        metadata: dict[str, str] = {},
+        metadata_provider: MetadataProvider | None = None,
+    ):
         self._client = client
         # This metadata is injected into all requests on all channels created by this manager.
         self._metadata = metadata
+        self._metadata_provider = metadata_provider
         self._channels: dict[str, asyncio.Future[grpclib.client.Channel]] = {}
 
     async def get_or_create_channel(self, server_url: str) -> grpclib.client.Channel:
         fut = self._channels.get(server_url)
         if fut is None or (fut.done() and (fut.cancelled() or fut.exception() is not None)):
             # Cache the attempt rather than the channel, so callers racing to connect share one.
-            fut = asyncio.ensure_future(create_channel_with_fallbacks(server_url, self._metadata))
+            fut = asyncio.ensure_future(
+                create_channel_with_fallbacks(
+                    server_url,
+                    self._metadata,
+                    metadata_provider=self._metadata_provider,
+                )
+            )
             self._channels[server_url] = fut
         # Shielded so one caller giving up doesn't cancel the connection for the others.
         return await asyncio.shield(fut)
@@ -357,6 +370,7 @@ def listen_for_server_warnings(channel: grpclib.client.Channel) -> None:
 def create_channel(
     server_url: str,
     metadata: dict[str, str] = {},
+    metadata_provider: MetadataProvider | None = None,
 ) -> grpclib.client.Channel:
     """Creates a grpclib.Channel to be used by a GRPC stub.
 
@@ -387,6 +401,10 @@ def create_channel(
     async def send_request(event: grpclib.events.SendRequest) -> None:
         for k, v in metadata.items():
             event.metadata[k] = v
+        if metadata_provider is not None:
+            provided_metadata = await asyncio.to_thread(metadata_provider)
+            for k, v in provided_metadata.items():
+                event.metadata[k] = v
 
         if o.hostname is not None:
             # GRPC actually injects a :authority pseudo-header containing the hostname.
@@ -412,6 +430,7 @@ async def create_channel_with_fallbacks(
     server_url: str,
     metadata: dict[str, str] = {},
     stagger_delay: float = 3.0,
+    metadata_provider: MetadataProvider | None = None,
 ) -> grpclib.client.Channel:
     """Create a connected channel, supporting comma-separated fallback URLs.
 
@@ -440,7 +459,7 @@ async def create_channel_with_fallbacks(
                 await asyncio.wait_for(failed[index - 1].wait(), timeout=index * stagger_delay)
             except asyncio.TimeoutError:
                 pass
-        channel = create_channel(url, metadata)
+        channel = create_channel(url, metadata, metadata_provider)
         try:
             await channel.__connect__()
         except BaseException:

modal-1.6.3.dev12/modal/_utils/oauth.py

@@ -0,0 +1,66 @@
+# Copyright Modal Labs 2026
+import base64
+import hashlib
+import json
+import time
+import uuid
+from collections.abc import Mapping
+from typing import Any
+
+from modal.exception import InvalidError
+
+_OAUTH_CLIENT_ASSERTION_AUDIENCE = "modal-server"
+_OAUTH_CLIENT_ASSERTION_LIFETIME_SECONDS = 5 * 60
+_MIN_RSA_KEY_SIZE = 2048
+
+
+class OAuthAssertionProvider:
+    """Mint short-lived private_key_jwt assertions for OAuth client authentication."""
+
+    def __init__(self, client_id: str, private_key_pem: str):
+        try:
+            import jwt
+            from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
+            from jwt.algorithms import RSAAlgorithm
+            from jwt.exceptions import InvalidKeyError
+        except ImportError:
+            raise ImportError(
+                "Private-key OAuth authentication requires the 'oauth' extra. "
+                "Install it with `pip install 'modal[oauth]'`."
+            ) from None
+
+        private_key_pem = private_key_pem.replace("\\n", "\n")
+        try:
+            private_key = RSAAlgorithm(RSAAlgorithm.SHA256).prepare_key(private_key_pem)
+        except (TypeError, InvalidKeyError):
+            raise InvalidError("oauth_jwt_key must be an unencrypted RSA private key encoded as PEM.") from None
+        if not isinstance(private_key, RSAPrivateKey):
+            raise InvalidError("oauth_jwt_key must be an RSA private key.")
+        if private_key.key_size < _MIN_RSA_KEY_SIZE:
+            raise InvalidError("oauth_jwt_key must be at least 2048 bits.")
+
+        public_jwk: dict[str, Any] = RSAAlgorithm.to_jwk(private_key.public_key(), as_dict=True)
+        thumbprint_jwk = {field: public_jwk[field] for field in ("e", "kty", "n")}
+        canonical_jwk = json.dumps(thumbprint_jwk, sort_keys=True, separators=(",", ":")).encode()
+
+        self._client_id = client_id
+        self._private_key = private_key
+        self._kid = base64.urlsafe_b64encode(hashlib.sha256(canonical_jwk).digest()).rstrip(b"=").decode()
+        self._jwt = jwt
+
+    def __call__(self) -> Mapping[str, str]:
+        issued_at = int(time.time())
+        assertion = self._jwt.encode(
+            {
+                "iss": self._client_id,
+                "sub": self._client_id,
+                "aud": _OAUTH_CLIENT_ASSERTION_AUDIENCE,
+                "iat": issued_at,
+                "exp": issued_at + _OAUTH_CLIENT_ASSERTION_LIFETIME_SECONDS,
+                "jti": str(uuid.uuid4()),
+            },
+            self._private_key,
+            algorithm="RS256",
+            headers={"kid": self._kid},
+        )
+        return {"x-modal-oauth-client-assertion": assertion}

{modal-1.6.3.dev11 → modal-1.6.3.dev12}/modal/cli/config.py

@@ -33,6 +33,8 @@ def show(redact: bool, include_internal: bool, json: bool):
         config_dict["oauth_refresh_token"] = "***"
     if redact and config_dict.get("oauth_client_secret"):
         config_dict["oauth_client_secret"] = "***"
+    if redact and config_dict.get("oauth_jwt_key"):
+        config_dict["oauth_jwt_key"] = "***"
 
     # Accept --json as a no-op for consistency; we may change the default formatting later
     OutputManager.get().print_json(dumps(config_dict))

{modal-1.6.3.dev11 → modal-1.6.3.dev12}/modal/cli/profile.py

@@ -67,6 +67,7 @@ async def list_(json: bool | None = False):
         "MODAL_OAUTH_REFRESH_TOKEN",
         "MODAL_OAUTH_CLIENT_ID",
         "MODAL_OAUTH_CLIENT_SECRET",
+        "MODAL_OAUTH_JWT_KEY",
     )
     if any(env_var in os.environ for env_var in credential_env_vars):
         try:

{modal-1.6.3.dev11 → modal-1.6.3.dev12}/modal/cli/token.py

@@ -36,6 +36,7 @@ async def info():
         "MODAL_OAUTH_REFRESH_TOKEN",
         "MODAL_OAUTH_CLIENT_ID",
         "MODAL_OAUTH_CLIENT_SECRET",
+        "MODAL_OAUTH_JWT_KEY",
     ):
         if os.environ.get(env_var):
             env_vars.append(env_var)

{modal-1.6.3.dev11 → modal-1.6.3.dev12}/modal/client.py

@@ -35,7 +35,8 @@ HEARTBEAT_TIMEOUT: float = HEARTBEAT_INTERVAL + 0.1
 class _OAuthCredentials:
     refresh_token: str = field(repr=False)
     client_id: str
-    client_secret: str = field(repr=False)
+    client_secret: str | None = field(default=None, repr=False)
+    jwt_key: str | None = field(default=None, repr=False)
 
 
 def _get_metadata(
@@ -75,9 +76,10 @@ def _get_metadata(
             {
                 "x-modal-refresh-token": oauth_credentials.refresh_token,
                 "x-modal-oauth-client-id": oauth_credentials.client_id,
-                "x-modal-oauth-client-secret": oauth_credentials.client_secret,
             }
         )
+        if oauth_credentials.client_secret:
+            metadata["x-modal-oauth-client-secret"] = oauth_credentials.client_secret
     if agent_env := _agent_environment():
         metadata["x-modal-agent-harness"] = urllib.parse.quote(agent_env)
 
@@ -209,7 +211,19 @@ class _Client:
         self._cancellation_context = TaskContext(grace=0.5)  # allow running rpcs to finish in 0.5s when closing client
         self._cancellation_context_event_loop = asyncio.get_running_loop()
         await self._cancellation_context.__aenter__()
-        self._connection_manager = ConnectionManager(client=self, metadata=metadata)
+        metadata_provider = None
+        if self._oauth_credentials and self._oauth_credentials.jwt_key:
+            from ._utils.oauth import OAuthAssertionProvider
+
+            metadata_provider = OAuthAssertionProvider(
+                self._oauth_credentials.client_id,
+                self._oauth_credentials.jwt_key,
+            )
+        self._connection_manager = ConnectionManager(
+            client=self,
+            metadata=metadata,
+            metadata_provider=metadata_provider,
+        )
         self._control_plane_stub = await self._get_stub(self.server_url)
         self._auth_token_manager = _AuthTokenManager(self._stub)
         self._owner_pid = os.getpid()
@@ -289,6 +303,7 @@ class _Client:
             oauth_refresh_token = c.get("oauth_refresh_token")
             oauth_client_id = c.get("oauth_client_id")
             oauth_client_secret = c.get("oauth_client_secret")
+            oauth_jwt_key = c.get("oauth_jwt_key")
             if _is_remote():
                 ignored_credential_settings = [
                     name
@@ -298,6 +313,7 @@ class _Client:
                         ("MODAL_OAUTH_REFRESH_TOKEN", oauth_refresh_token),
                         ("MODAL_OAUTH_CLIENT_ID", oauth_client_id),
                         ("MODAL_OAUTH_CLIENT_SECRET", oauth_client_secret),
+                        ("MODAL_OAUTH_JWT_KEY", oauth_jwt_key),
                     )
                     if value
                 ]
@@ -311,18 +327,26 @@ class _Client:
                 oauth_credentials = None
             else:
                 has_token_config = bool(token_id or token_secret)
-                has_oauth_config = bool(oauth_refresh_token or oauth_client_id or oauth_client_secret)
+                has_oauth_config = bool(oauth_refresh_token or oauth_client_id or oauth_client_secret or oauth_jwt_key)
                 if has_token_config and has_oauth_config:
                     raise InvalidError("Modal token credentials and OAuth credentials cannot both be configured.")
                 if has_oauth_config:
-                    if not oauth_refresh_token or not oauth_client_id or not oauth_client_secret:
-                        raise InvalidError("OAuth refresh token, client ID, and client secret must all be configured.")
+                    if (
+                        not oauth_refresh_token
+                        or not oauth_client_id
+                        or bool(oauth_client_secret) == bool(oauth_jwt_key)
+                    ):
+                        raise InvalidError(
+                            "OAuth refresh token, client ID, and exactly one of client secret or JWT key "
+                            "must be configured."
+                        )
                     client_type = api_pb2.CLIENT_TYPE_CLIENT
                     credentials = None
                     oauth_credentials = _OAuthCredentials(
                         refresh_token=oauth_refresh_token,
                         client_id=oauth_client_id,
                         client_secret=oauth_client_secret,
+                        jwt_key=oauth_jwt_key,
                     )
                 elif token_id and token_secret:
                     client_type = api_pb2.CLIENT_TYPE_CLIENT
@@ -392,7 +416,8 @@ class _Client:
         refresh_token: str,
         *,
         oauth_client_id: str,
-        oauth_client_secret: str,
+        oauth_client_secret: str | None = None,
+        oauth_jwt_key: str | None = None,
     ) -> "_Client":
         """
         Constructor based on OAuth credentials; useful for managing Modal on behalf of third-party users.
@@ -401,6 +426,8 @@ class _Client:
             refresh_token: OAuth refresh token returned by Modal's token endpoint.
             oauth_client_id: Modal-issued OAuth client ID, with an `oc-` prefix.
             oauth_client_secret: Modal-issued OAuth client secret, with an `ov-` prefix.
+            oauth_jwt_key: Unencrypted RSA private key encoded as PEM, with literal or escaped newlines.
+                Requires `modal[oauth]`.
 
         Returns:
             An authenticated `Client` with its connection opened.
@@ -417,8 +444,10 @@ class _Client:
             ```
         """
         _check_config()
-        if not refresh_token or not oauth_client_id or not oauth_client_secret:
-            raise AuthError("OAuth refresh token, client ID, and client secret must all be provided.")
+        if not refresh_token or not oauth_client_id or bool(oauth_client_secret) == bool(oauth_jwt_key):
+            raise AuthError(
+                "OAuth refresh token, client ID, and exactly one of client secret or JWT key must be provided."
+            )
 
         server_url = config["server_url"]
         client_type = api_pb2.CLIENT_TYPE_CLIENT
@@ -426,6 +455,7 @@ class _Client:
             refresh_token=refresh_token,
             client_id=oauth_client_id,
             client_secret=oauth_client_secret,
+            jwt_key=oauth_jwt_key,
         )
         client = _Client(
             server_url,

{modal-1.6.3.dev11 → modal-1.6.3.dev12}/modal/client.pyi

@@ -12,13 +12,20 @@ import typing
 import typing_extensions
 
 class _OAuthCredentials:
-    """_OAuthCredentials(refresh_token: str, client_id: str, client_secret: str)"""
+    """_OAuthCredentials(refresh_token: str, client_id: str, client_secret: str | None = None, jwt_key: str | None = None)"""
 
     refresh_token: str
     client_id: str
-    client_secret: str
+    client_secret: typing.Optional[str]
+    jwt_key: typing.Optional[str]
 
-    def __init__(self, refresh_token: str, client_id: str, client_secret: str) -> None:
+    def __init__(
+        self,
+        refresh_token: str,
+        client_id: str,
+        client_secret: typing.Optional[str] = None,
+        jwt_key: typing.Optional[str] = None,
+    ) -> None:
         """Initialize self.  See help(type(self)) for accurate signature."""
         ...
 
@@ -80,7 +87,7 @@ class _Client:
         server_url: str,
         client_type: int,
         credentials: typing.Optional[tuple[str, str]],
-        version: str = "1.6.3.dev11",
+        version: str = "1.6.3.dev12",
         *,
         oauth_credentials: typing.Optional[_OAuthCredentials] = None,
     ):
@@ -190,7 +197,12 @@ class _Client:
 
     @classmethod
     async def from_oauth_credentials(
-        cls, refresh_token: str, *, oauth_client_id: str, oauth_client_secret: str
+        cls,
+        refresh_token: str,
+        *,
+        oauth_client_id: str,
+        oauth_client_secret: typing.Optional[str] = None,
+        oauth_jwt_key: typing.Optional[str] = None,
     ) -> _Client:
         """Constructor based on OAuth credentials; useful for managing Modal on behalf of third-party users.
 
@@ -198,6 +210,8 @@ class _Client:
             refresh_token: OAuth refresh token returned by Modal's token endpoint.
             oauth_client_id: Modal-issued OAuth client ID, with an `oc-` prefix.
             oauth_client_secret: Modal-issued OAuth client secret, with an `ov-` prefix.
+            oauth_jwt_key: Unencrypted RSA private key encoded as PEM, with literal or escaped newlines.
+                Requires `modal[oauth]`.
 
         Returns:
             An authenticated `Client` with its connection opened.
@@ -290,7 +304,7 @@ class Client:
         server_url: str,
         client_type: int,
         credentials: typing.Optional[tuple[str, str]],
-        version: str = "1.6.3.dev11",
+        version: str = "1.6.3.dev12",
         *,
         oauth_credentials: typing.Optional[_OAuthCredentials] = None,
     ):
@@ -490,13 +504,23 @@ class Client:
     from_credentials: typing.ClassVar[__from_credentials_spec]
 
     class __from_oauth_credentials_spec(typing_extensions.Protocol):
-        def __call__(self, /, refresh_token: str, *, oauth_client_id: str, oauth_client_secret: str) -> Client:
+        def __call__(
+            self,
+            /,
+            refresh_token: str,
+            *,
+            oauth_client_id: str,
+            oauth_client_secret: typing.Optional[str] = None,
+            oauth_jwt_key: typing.Optional[str] = None,
+        ) -> Client:
             """Constructor based on OAuth credentials; useful for managing Modal on behalf of third-party users.
 
             Args:
                 refresh_token: OAuth refresh token returned by Modal's token endpoint.
                 oauth_client_id: Modal-issued OAuth client ID, with an `oc-` prefix.
                 oauth_client_secret: Modal-issued OAuth client secret, with an `ov-` prefix.
+                oauth_jwt_key: Unencrypted RSA private key encoded as PEM, with literal or escaped newlines.
+                    Requires `modal[oauth]`.
 
             Returns:
                 An authenticated `Client` with its connection opened.
@@ -514,13 +538,23 @@ class Client:
             """
             ...
 
-        async def aio(self, /, refresh_token: str, *, oauth_client_id: str, oauth_client_secret: str) -> Client:
+        async def aio(
+            self,
+            /,
+            refresh_token: str,
+            *,
+            oauth_client_id: str,
+            oauth_client_secret: typing.Optional[str] = None,
+            oauth_jwt_key: typing.Optional[str] = None,
+        ) -> Client:
             """Constructor based on OAuth credentials; useful for managing Modal on behalf of third-party users.
 
             Args:
                 refresh_token: OAuth refresh token returned by Modal's token endpoint.
                 oauth_client_id: Modal-issued OAuth client ID, with an `oc-` prefix.
                 oauth_client_secret: Modal-issued OAuth client secret, with an `ov-` prefix.
+                oauth_jwt_key: Unencrypted RSA private key encoded as PEM, with literal or escaped newlines.
+                    Requires `modal[oauth]`.
 
             Returns:
                 An authenticated `Client` with its connection opened.

{modal-1.6.3.dev11 → modal-1.6.3.dev12}/modal/config.py

@@ -9,7 +9,8 @@ Client processes can authenticate in two ways:
 1. Modal API tokens use `MODAL_TOKEN_ID` and `MODAL_TOKEN_SECRET`. The
    `modal token set` command stores these values in `.modal.toml`.
 2. Third-party OAuth integrations typically inject `MODAL_OAUTH_REFRESH_TOKEN`,
-   `MODAL_OAUTH_CLIENT_ID`, and `MODAL_OAUTH_CLIENT_SECRET` into the process.
+   `MODAL_OAUTH_CLIENT_ID`, and either `MODAL_OAUTH_CLIENT_SECRET` or
+   `MODAL_OAUTH_JWT_KEY` into the process.
 
 The two authentication methods cannot be combined, and all values for the
 selected method must be provided.
@@ -370,6 +371,7 @@ _SETTINGS = {
     "oauth_refresh_token": _Setting(),
     "oauth_client_id": _Setting(),
     "oauth_client_secret": _Setting(),
+    "oauth_jwt_key": _Setting(),
     # --- Logging ----------------------------------------------------------------
     "loglevel": _Setting("WARNING", lambda s: s.upper()),
     "log_format": _Setting("STRING", lambda s: s.upper()),