pipedream 2.1.20__tar.gz → 2.2.0__tar.gz

{pipedream-2.1.20 → pipedream-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pipedream
-Version: 2.1.20
+Version: 2.2.0
 Summary: 
 Requires-Python: >=3.10,<4.0
 Classifier: Intended Audience :: Developers
@@ -20,11 +20,14 @@ Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Typing :: Typed
 Provides-Extra: aiohttp
+Provides-Extra: private-key
 Requires-Dist: aiohttp (>=3.13.4,<4) ; (python_version >= "3.9") and (extra == "aiohttp")
+Requires-Dist: cryptography (>=3.4.0) ; extra == "private-key"
 Requires-Dist: httpx (>=0.21.2)
 Requires-Dist: httpx-aiohttp (==0.1.8) ; (python_version >= "3.9") and (extra == "aiohttp")
 Requires-Dist: pydantic (>=1.9.2)
 Requires-Dist: pydantic-core (>=2.18.2,<3.0.0)
+Requires-Dist: pyjwt (>=2.8.0,<3) ; extra == "private-key"
 Requires-Dist: typing_extensions (>=4.0.0)
 Project-URL: Repository, https://github.com/PipedreamHQ/pipedream-sdk-python
 Description-Content-Type: text/markdown

{pipedream-2.1.20 → pipedream-2.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ dynamic = ["version"]
 
 [tool.poetry]
 name = "pipedream"
-version = "2.1.20"
+version = "2.2.0"
 description = ""
 readme = "README.md"
 authors = []
@@ -38,10 +38,12 @@ Repository = 'https://github.com/PipedreamHQ/pipedream-sdk-python'
 [tool.poetry.dependencies]
 python = "^3.10"
 aiohttp = { version = ">=3.13.4,<4", optional = true, python = ">=3.9"}
+cryptography = { version = ">=3.4.0", optional = true}
 httpx = ">=0.21.2"
 httpx-aiohttp = { version = "0.1.8", optional = true, python = ">=3.9"}
 pydantic = ">= 1.9.2"
 pydantic-core = ">=2.18.2,<3.0.0"
+pyjwt = { version = ">=2.8.0,<3", optional = true}
 typing_extensions = ">= 4.0.0"
 
 [tool.poetry.group.dev.dependencies]
@@ -93,4 +95,5 @@ requires = ["poetry-core"]
 build-backend = "poetry.core.masonry.api"
 
 [tool.poetry.extras]
+private-key=["pyjwt", "cryptography"]
 aiohttp=["aiohttp", "httpx-aiohttp"]

{pipedream-2.1.20 → pipedream-2.2.0}/src/pipedream/core/client_wrapper.py

@@ -34,12 +34,12 @@ class BaseClientWrapper:
         import platform
 
         headers: typing.Dict[str, str] = {
-            "User-Agent": "pipedream/2.1.20",
+            "User-Agent": "pipedream/2.2.0",
             "X-Fern-Language": "Python",
             "X-Fern-Runtime": f"python/{platform.python_version()}",
             "X-Fern-Platform": f"{platform.system().lower()}/{platform.release()}",
             "X-Fern-SDK-Name": "pipedream",
-            "X-Fern-SDK-Version": "2.1.20",
+            "X-Fern-SDK-Version": "2.2.0",
             **(self.get_custom_headers() or {}),
         }
         if self._project_environment is not None:

{pipedream-2.1.20 → pipedream-2.2.0}/src/pipedream/oauth_tokens/client.py

@@ -30,7 +30,11 @@ class OauthTokensClient:
         self,
         *,
         client_id: str,
-        client_secret: str,
+        client_secret: typing.Optional[str] = OMIT,
+        client_assertion_type: typing.Optional[
+            typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]
+        ] = OMIT,
+        client_assertion: typing.Optional[str] = OMIT,
         scope: typing.Optional[str] = OMIT,
         request_options: typing.Optional[RequestOptions] = None,
     ) -> CreateOAuthTokenResponse:
@@ -41,7 +45,14 @@ class OauthTokensClient:
         ----------
         client_id : str
 
-        client_secret : str
+        client_secret : typing.Optional[str]
+            The client secret, for clients that authenticate with a client secret.
+
+        client_assertion_type : typing.Optional[typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]]
+            Required with `client_assertion`.
+
+        client_assertion : typing.Optional[str]
+            For clients that authenticate with a public key: a JWT signed with the client's private key (ES256 or RS256). Claims: `iss` and `sub` set to the client ID, `aud` set to `https://api.pipedream.com`, `exp` at most 1 hour ahead, and a unique `jti`. Sign a new assertion for every request, including retries.
 
         scope : typing.Optional[str]
             Optional space-separated scopes for the access token. Defaults to `*`.
@@ -65,11 +76,15 @@ class OauthTokensClient:
         )
         client.oauth_tokens.create(
             client_id="client_id",
-            client_secret="client_secret",
         )
         """
         _response = self._raw_client.create(
-            client_id=client_id, client_secret=client_secret, scope=scope, request_options=request_options
+            client_id=client_id,
+            client_secret=client_secret,
+            client_assertion_type=client_assertion_type,
+            client_assertion=client_assertion,
+            scope=scope,
+            request_options=request_options,
         )
         return _response.data
 
@@ -93,7 +108,11 @@ class AsyncOauthTokensClient:
         self,
         *,
         client_id: str,
-        client_secret: str,
+        client_secret: typing.Optional[str] = OMIT,
+        client_assertion_type: typing.Optional[
+            typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]
+        ] = OMIT,
+        client_assertion: typing.Optional[str] = OMIT,
         scope: typing.Optional[str] = OMIT,
         request_options: typing.Optional[RequestOptions] = None,
     ) -> CreateOAuthTokenResponse:
@@ -104,7 +123,14 @@ class AsyncOauthTokensClient:
         ----------
         client_id : str
 
-        client_secret : str
+        client_secret : typing.Optional[str]
+            The client secret, for clients that authenticate with a client secret.
+
+        client_assertion_type : typing.Optional[typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]]
+            Required with `client_assertion`.
+
+        client_assertion : typing.Optional[str]
+            For clients that authenticate with a public key: a JWT signed with the client's private key (ES256 or RS256). Claims: `iss` and `sub` set to the client ID, `aud` set to `https://api.pipedream.com`, `exp` at most 1 hour ahead, and a unique `jti`. Sign a new assertion for every request, including retries.
 
         scope : typing.Optional[str]
             Optional space-separated scopes for the access token. Defaults to `*`.
@@ -133,13 +159,17 @@ class AsyncOauthTokensClient:
         async def main() -> None:
             await client.oauth_tokens.create(
                 client_id="client_id",
-                client_secret="client_secret",
             )
 
 
         asyncio.run(main())
         """
         _response = await self._raw_client.create(
-            client_id=client_id, client_secret=client_secret, scope=scope, request_options=request_options
+            client_id=client_id,
+            client_secret=client_secret,
+            client_assertion_type=client_assertion_type,
+            client_assertion=client_assertion,
+            scope=scope,
+            request_options=request_options,
         )
         return _response.data

{pipedream-2.1.20 → pipedream-2.2.0}/src/pipedream/oauth_tokens/raw_client.py

@@ -25,7 +25,11 @@ class RawOauthTokensClient:
         self,
         *,
         client_id: str,
-        client_secret: str,
+        client_secret: typing.Optional[str] = OMIT,
+        client_assertion_type: typing.Optional[
+            typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]
+        ] = OMIT,
+        client_assertion: typing.Optional[str] = OMIT,
         scope: typing.Optional[str] = OMIT,
         request_options: typing.Optional[RequestOptions] = None,
     ) -> HttpResponse[CreateOAuthTokenResponse]:
@@ -36,7 +40,14 @@ class RawOauthTokensClient:
         ----------
         client_id : str
 
-        client_secret : str
+        client_secret : typing.Optional[str]
+            The client secret, for clients that authenticate with a client secret.
+
+        client_assertion_type : typing.Optional[typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]]
+            Required with `client_assertion`.
+
+        client_assertion : typing.Optional[str]
+            For clients that authenticate with a public key: a JWT signed with the client's private key (ES256 or RS256). Claims: `iss` and `sub` set to the client ID, `aud` set to `https://api.pipedream.com`, `exp` at most 1 hour ahead, and a unique `jti`. Sign a new assertion for every request, including retries.
 
         scope : typing.Optional[str]
             Optional space-separated scopes for the access token. Defaults to `*`.
@@ -55,6 +66,8 @@ class RawOauthTokensClient:
             json={
                 "client_id": client_id,
                 "client_secret": client_secret,
+                "client_assertion_type": client_assertion_type,
+                "client_assertion": client_assertion,
                 "scope": scope,
                 "grant_type": "client_credentials",
             },
@@ -103,7 +116,11 @@ class AsyncRawOauthTokensClient:
         self,
         *,
         client_id: str,
-        client_secret: str,
+        client_secret: typing.Optional[str] = OMIT,
+        client_assertion_type: typing.Optional[
+            typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]
+        ] = OMIT,
+        client_assertion: typing.Optional[str] = OMIT,
         scope: typing.Optional[str] = OMIT,
         request_options: typing.Optional[RequestOptions] = None,
     ) -> AsyncHttpResponse[CreateOAuthTokenResponse]:
@@ -114,7 +131,14 @@ class AsyncRawOauthTokensClient:
         ----------
         client_id : str
 
-        client_secret : str
+        client_secret : typing.Optional[str]
+            The client secret, for clients that authenticate with a client secret.
+
+        client_assertion_type : typing.Optional[typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]]
+            Required with `client_assertion`.
+
+        client_assertion : typing.Optional[str]
+            For clients that authenticate with a public key: a JWT signed with the client's private key (ES256 or RS256). Claims: `iss` and `sub` set to the client ID, `aud` set to `https://api.pipedream.com`, `exp` at most 1 hour ahead, and a unique `jti`. Sign a new assertion for every request, including retries.
 
         scope : typing.Optional[str]
             Optional space-separated scopes for the access token. Defaults to `*`.
@@ -133,6 +157,8 @@ class AsyncRawOauthTokensClient:
             json={
                 "client_id": client_id,
                 "client_secret": client_secret,
+                "client_assertion_type": client_assertion_type,
+                "client_assertion": client_assertion,
                 "scope": scope,
                 "grant_type": "client_credentials",
             },

{pipedream-2.1.20 → pipedream-2.2.0}/src/pipedream/pipedream.py

@@ -5,6 +5,12 @@ import httpx
 from .client import AsyncClient, Client
 from .core.client_wrapper import AsyncClientWrapper, SyncClientWrapper
 from .core.logging import LogConfig, Logger
+from .private_key_jwt import (
+    AsyncPrivateKeyJwtTokenProvider,
+    ClientAssertionSigner,
+    PrivateKeyJwtTokenProvider,
+    issuer_from_base_url,
+)
 from .types.project_environment import ProjectEnvironment
 from .workflows.client import AsyncWorkflowsClient, WorkflowsClient
 
@@ -31,6 +37,52 @@ def install_request_hook(
     ).append(hook)
 
 
+def _resolve_credentials(
+    client_secret: typing.Optional[str],
+    private_key: typing.Optional[str],
+) -> typing.Tuple[typing.Optional[str], typing.Optional[str]]:
+    """Returns (client_secret, private_key) with at most one of them set.
+
+    An explicitly passed credential wins over the other one in the environment.
+    Passing both, or setting both PIPEDREAM_CLIENT_SECRET and
+    PIPEDREAM_PRIVATE_KEY with neither passed, raises ValueError.
+    """
+    env_secret = os.getenv("PIPEDREAM_CLIENT_SECRET")
+    # client_secret defaults to the environment variable, so a value equal to
+    # it is treated as coming from the environment.
+    secret_passed = bool(client_secret) and client_secret != env_secret
+    if private_key and secret_passed:
+        raise ValueError("Pass either client_secret or private_key, not both")
+    if private_key:
+        return None, private_key
+    if secret_passed:
+        return client_secret, None
+    env_key = os.getenv("PIPEDREAM_PRIVATE_KEY")
+    if client_secret and env_key:
+        raise ValueError(
+            "Both PIPEDREAM_CLIENT_SECRET and PIPEDREAM_PRIVATE_KEY are set; set only the one your client uses"
+        )
+    return client_secret, env_key
+
+
+def _assertion_signer(
+    client_id: typing.Optional[str],
+    private_key: str,
+    key_id: typing.Optional[str],
+    base_url: str,
+) -> ClientAssertionSigner:
+    if not client_id:
+        raise ValueError("client_id is required when authenticating with private_key")
+    return ClientAssertionSigner(
+        client_id=client_id,
+        private_key=private_key,
+        key_id=key_id or os.getenv("PIPEDREAM_KEY_ID"),
+        # The assertion audience is the API's issuer identifier: the base URL's
+        # origin (https://api.pipedream.com by default).
+        audience=issuer_from_base_url(base_url),
+    )
+
+
 class Pipedream(Client):
 
     def __init__(
@@ -39,6 +91,8 @@ class Pipedream(Client):
         access_token: typing.Optional[str] = os.getenv("PIPEDREAM_ACCESS_TOKEN"),
         client_id: typing.Optional[str] = os.getenv("PIPEDREAM_CLIENT_ID"),
         client_secret: typing.Optional[str] = os.getenv("PIPEDREAM_CLIENT_SECRET"),
+        private_key: typing.Optional[str] = None,
+        key_id: typing.Optional[str] = None,
         project_id: typing.Optional[str] = os.getenv("PIPEDREAM_PROJECT_ID"),
         project_environment: typing.Optional[ProjectEnvironment] = os.getenv(
             "PIPEDREAM_PROJECT_ENVIRONMENT",
@@ -73,8 +127,30 @@ class Pipedream(Client):
             logging=logging,
         )
 
+        client_secret, private_key = _resolve_credentials(client_secret, private_key)
+
         if access_token:
             super().__init__(token=(lambda: access_token), **common_kwargs)
+        elif private_key:
+            signer = _assertion_signer(client_id, private_key, key_id, resolved_base_url)
+            super().__init__(token=lambda: self._token_provider.get_token(), **common_kwargs)
+            # Token requests use their own unauthenticated wrapper over the same
+            # HTTP client, like the generated client-secret flow.
+            wrapper = self._client_wrapper
+            self._token_provider = PrivateKeyJwtTokenProvider(
+                client_id=typing.cast(str, client_id),
+                signer=signer,
+                client_wrapper=SyncClientWrapper(
+                    project_id=project_id,
+                    project_environment=project_environment,
+                    headers=headers,
+                    base_url=wrapper.get_base_url(),
+                    timeout=wrapper.get_timeout(),
+                    max_retries=wrapper.get_max_retries(),
+                    logging=logging,
+                    httpx_client=wrapper.httpx_client.httpx_client,
+                ),
+            )
         else:
             super().__init__(client_id=client_id, client_secret=client_secret, **common_kwargs)
 
@@ -101,6 +177,8 @@ class AsyncPipedream(AsyncClient):
         access_token: typing.Optional[str] = os.getenv("PIPEDREAM_ACCESS_TOKEN"),
         client_id: typing.Optional[str] = os.getenv("PIPEDREAM_CLIENT_ID"),
         client_secret: typing.Optional[str] = os.getenv("PIPEDREAM_CLIENT_SECRET"),
+        private_key: typing.Optional[str] = None,
+        key_id: typing.Optional[str] = None,
         project_id: typing.Optional[str] = os.getenv("PIPEDREAM_PROJECT_ID"),
         project_environment: typing.Optional[ProjectEnvironment] = os.getenv(
             "PIPEDREAM_PROJECT_ENVIRONMENT",
@@ -135,8 +213,33 @@ class AsyncPipedream(AsyncClient):
             logging=logging,
         )
 
+        client_secret, private_key = _resolve_credentials(client_secret, private_key)
+
         if access_token:
             super().__init__(token=(lambda: access_token), **common_kwargs)
+        elif private_key:
+            signer = _assertion_signer(client_id, private_key, key_id, resolved_base_url)
+            super().__init__(token=(lambda: ""), **common_kwargs)
+            # Wire the async token provider the way the generated client-secret
+            # flow does: no sync token, an async one, and token requests on
+            # their own unauthenticated wrapper over the same HTTP client.
+            wrapper = self._client_wrapper
+            token_provider = AsyncPrivateKeyJwtTokenProvider(
+                client_id=typing.cast(str, client_id),
+                signer=signer,
+                client_wrapper=AsyncClientWrapper(
+                    project_id=project_id,
+                    project_environment=project_environment,
+                    headers=headers,
+                    base_url=wrapper.get_base_url(),
+                    timeout=wrapper.get_timeout(),
+                    max_retries=wrapper.get_max_retries(),
+                    logging=logging,
+                    httpx_client=wrapper.httpx_client.httpx_client,
+                ),
+            )
+            wrapper._token = None
+            wrapper._async_token = token_provider.get_token
         else:
             super().__init__(client_id=client_id, client_secret=client_secret, **common_kwargs)
 

pipedream-2.2.0/src/pipedream/private_key_jwt.py

@@ -0,0 +1,204 @@
+"""Client assertions for private_key_jwt client authentication (RFC 7523).
+
+An OAuth client that registered a public key authenticates at the token
+endpoint with a short-lived JWT signed by the matching private key, instead of
+a client secret. Requires the optional ``private-key`` extra:
+``pip install "pipedream[private-key]"`` (PyJWT with cryptography).
+"""
+
+import asyncio
+import datetime as dt
+import json
+import threading
+import time
+import typing
+import uuid
+from urllib.parse import urlsplit
+
+import httpx
+from .core.api_error import ApiError
+from .core.client_wrapper import AsyncClientWrapper, SyncClientWrapper
+from .oauth_tokens.client import AsyncOauthTokensClient, OauthTokensClient
+from .types.create_o_auth_token_response import CreateOAuthTokenResponse
+
+CLIENT_ASSERTION_TYPE: typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"] = (
+    "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
+)
+
+# Assertions are single-use and only need to outlive one token request.
+_ASSERTION_LIFETIME_SECONDS = 60
+# Token requests authenticated with an assertion are retried here rather than
+# by the HTTP client, so each attempt carries a newly signed assertion: the
+# server rejects a reused one.
+_MAX_RETRIES = 2
+_TOKEN_BUFFER = dt.timedelta(minutes=2)
+
+
+def issuer_from_base_url(base_url: str) -> str:
+    """The API's issuer identifier: the base URL's origin, without a trailing slash."""
+    parts = urlsplit(base_url)
+    return f"{parts.scheme}://{parts.netloc}"
+
+
+class ClientAssertionSigner:
+    """Signs a new client assertion on every call to :meth:`sign`.
+
+    The assertion is a JWT with ``iss`` and ``sub`` set to the client ID, the
+    given ``aud``, a 60-second lifetime, and a random single-use ``jti``. The
+    private key may be a PEM string (PKCS#8, PKCS#1, or SEC1) or a JWK as a JSON
+    string; EC P-256 keys sign with ES256 and RSA keys with RS256. ``key_id``
+    is sent as the ``kid`` header and defaults to the JWK's ``kid``, if any.
+    The key is parsed and validated on construction.
+    """
+
+    def __init__(self, *, client_id: str, private_key: str, audience: str, key_id: typing.Optional[str] = None):
+        try:
+            import jwt  # noqa: F401  (PyJWT)
+            from cryptography.hazmat.primitives.asymmetric import ec, rsa
+        except ImportError as e:
+            raise ImportError(
+                'Authenticating with a private key requires the "private-key" extra: '
+                'pip install "pipedream[private-key]"'
+            ) from e
+
+        self._client_id = client_id
+        self._audience = audience
+        self._key, jwk_kid = _load_private_key(private_key.strip())
+        self._key_id = key_id or jwk_kid
+
+        if isinstance(self._key, ec.EllipticCurvePrivateKey) and isinstance(self._key.curve, ec.SECP256R1):
+            self._alg = "ES256"
+        elif isinstance(self._key, rsa.RSAPrivateKey):
+            self._alg = "RS256"
+        else:
+            raise ValueError("private_key must be an EC P-256 key (ES256) or an RSA key (RS256)")
+
+    def sign(self) -> str:
+        import jwt
+
+        now = int(time.time())
+        headers: typing.Dict[str, str] = {"typ": "client-authentication+jwt"}
+        if self._key_id:
+            headers["kid"] = self._key_id
+        claims = {
+            "iss": self._client_id,
+            "sub": self._client_id,
+            "aud": self._audience,
+            "iat": now,
+            "exp": now + _ASSERTION_LIFETIME_SECONDS,
+            "jti": str(uuid.uuid4()),
+        }
+        return jwt.encode(claims, typing.cast(typing.Any, self._key), algorithm=self._alg, headers=headers)
+
+
+def _load_private_key(text: str) -> typing.Tuple[typing.Any, typing.Optional[str]]:
+    import jwt
+    from cryptography.hazmat.primitives.serialization import load_pem_private_key
+
+    try:
+        if text.startswith("{"):
+            jwk = json.loads(text)
+            key = jwt.PyJWK(jwk).key
+            kid = jwk.get("kid") if isinstance(jwk.get("kid"), str) else None
+            if not hasattr(key, "sign"):
+                raise ValueError("not a private key")
+            return key, kid
+        return load_pem_private_key(text.encode(), password=None), None
+    except Exception as e:
+        raise ValueError(
+            "private_key must be a private key in PEM format or a JWK (JSON). "
+            "If you passed a public key, pass the private key instead."
+        ) from e
+
+
+def _is_retryable(error: Exception) -> bool:
+    # Rate limits, timeouts, connection failures, and server errors are
+    # transient; 4xx errors such as invalid_client are not.
+    if isinstance(error, (httpx.TimeoutException, httpx.TransportError)):
+        return True
+    if isinstance(error, ApiError):
+        status = error.status_code
+        return status is None or status in (408, 429) or status >= 500
+    return False
+
+
+def _expires_at(token: CreateOAuthTokenResponse) -> dt.datetime:
+    return dt.datetime.now() + dt.timedelta(seconds=token.expires_in) - _TOKEN_BUFFER
+
+
+class PrivateKeyJwtTokenProvider:
+    """Retrieves and caches an OAuth access token, authenticating with client assertions."""
+
+    def __init__(self, *, client_id: str, signer: ClientAssertionSigner, client_wrapper: SyncClientWrapper):
+        self._client_id = client_id
+        self._signer = signer
+        self._auth_client = OauthTokensClient(client_wrapper=client_wrapper)
+        self._access_token: typing.Optional[str] = None
+        self._expires_at = dt.datetime.now()
+        self._lock = threading.Lock()
+
+    def get_token(self) -> str:
+        if self._access_token and self._expires_at > dt.datetime.now():
+            return self._access_token
+        with self._lock:
+            if self._access_token and self._expires_at > dt.datetime.now():
+                return self._access_token
+            token = self._request_token()
+            self._access_token = token.access_token
+            self._expires_at = _expires_at(token)
+            return self._access_token
+
+    def _request_token(self) -> CreateOAuthTokenResponse:
+        attempt = 0
+        while True:
+            try:
+                return self._auth_client.create(
+                    client_id=self._client_id,
+                    client_assertion_type=CLIENT_ASSERTION_TYPE,
+                    client_assertion=self._signer.sign(),
+                    request_options={"max_retries": 0},
+                )
+            except Exception as e:
+                if attempt >= _MAX_RETRIES or not _is_retryable(e):
+                    raise
+                time.sleep(0.5 * 2**attempt)
+                attempt += 1
+
+
+class AsyncPrivateKeyJwtTokenProvider:
+    """Async variant of :class:`PrivateKeyJwtTokenProvider`."""
+
+    def __init__(self, *, client_id: str, signer: ClientAssertionSigner, client_wrapper: AsyncClientWrapper):
+        self._client_id = client_id
+        self._signer = signer
+        self._auth_client = AsyncOauthTokensClient(client_wrapper=client_wrapper)
+        self._access_token: typing.Optional[str] = None
+        self._expires_at = dt.datetime.now()
+        self._lock = asyncio.Lock()
+
+    async def get_token(self) -> str:
+        if self._access_token and self._expires_at > dt.datetime.now():
+            return self._access_token
+        async with self._lock:
+            if self._access_token and self._expires_at > dt.datetime.now():
+                return self._access_token
+            token = await self._request_token()
+            self._access_token = token.access_token
+            self._expires_at = _expires_at(token)
+            return self._access_token
+
+    async def _request_token(self) -> CreateOAuthTokenResponse:
+        attempt = 0
+        while True:
+            try:
+                return await self._auth_client.create(
+                    client_id=self._client_id,
+                    client_assertion_type=CLIENT_ASSERTION_TYPE,
+                    client_assertion=self._signer.sign(),
+                    request_options={"max_retries": 0},
+                )
+            except Exception as e:
+                if attempt >= _MAX_RETRIES or not _is_retryable(e):
+                    raise
+                await asyncio.sleep(0.5 * 2**attempt)
+                attempt += 1