scalekit-sdk-python 2.19.1__tar.gz → 2.21.0__tar.gz

{scalekit_sdk_python-2.19.1 → scalekit_sdk_python-2.21.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scalekit-sdk-python
-Version: 2.19.1
+Version: 2.21.0
 Summary: Scalekit official Python SDK
 Home-page: https://github.com/scalekit-inc/scalekit-sdk-python
 Author: Team Scalekit
@@ -60,7 +60,7 @@ Dynamic: summary
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Python versions](https://img.shields.io/pypi/pyversions/scalekit-sdk-python.svg?style=flat-square)](https://pypi.org/project/scalekit-sdk-python/)
 
-<a href="https://scalekit.com" target="_blank" rel="noopener noreferrer">Scalekit</a> is the **auth stack for AI apps** - from human authentication to agent authorization. Build secure AI products faster with authentication for humans (SSO, passwordless, full-stack auth) and agents (MCP/APIs, delegated actions), all unified on one platform. This Python SDK enables both traditional B2B authentication and cutting-edge agentic workflows.
+<a href="https://scalekit.com" target="_blank" rel="noopener noreferrer">Scalekit</a> provides auth and actions on behalf of users, with 500+ connectors and 20,000+ tools. Build secure AI products faster with authentication for humans (SSO, passwordless, full-stack auth) and agents (MCP/APIs, delegated actions), all unified on one platform. This Python SDK enables both traditional B2B authentication and cutting-edge agentic workflows.
 
 ## 🤖 Agent-First Features
 

{scalekit_sdk_python-2.19.1 → scalekit_sdk_python-2.21.0}/README.md

@@ -13,7 +13,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Python versions](https://img.shields.io/pypi/pyversions/scalekit-sdk-python.svg?style=flat-square)](https://pypi.org/project/scalekit-sdk-python/)
 
-<a href="https://scalekit.com" target="_blank" rel="noopener noreferrer">Scalekit</a> is the **auth stack for AI apps** - from human authentication to agent authorization. Build secure AI products faster with authentication for humans (SSO, passwordless, full-stack auth) and agents (MCP/APIs, delegated actions), all unified on one platform. This Python SDK enables both traditional B2B authentication and cutting-edge agentic workflows.
+<a href="https://scalekit.com" target="_blank" rel="noopener noreferrer">Scalekit</a> provides auth and actions on behalf of users, with 500+ connectors and 20,000+ tools. Build secure AI products faster with authentication for humans (SSO, passwordless, full-stack auth) and agents (MCP/APIs, delegated actions), all unified on one platform. This Python SDK enables both traditional B2B authentication and cutting-edge agentic workflows.
 
 ## 🤖 Agent-First Features
 

{scalekit_sdk_python-2.19.1 → scalekit_sdk_python-2.21.0}/scalekit/_version.py

@@ -1,3 +1,3 @@
 # Single source of truth for the SDK version.
 # Import this in setup.py and scalekit/core.py — never hardcode the version elsewhere.
-__version__ = "2.19.1"
+__version__ = "2.21.0"

{scalekit_sdk_python-2.19.1 → scalekit_sdk_python-2.21.0}/scalekit/actions/actions.py

@@ -1,5 +1,5 @@
 from datetime import timedelta
-from typing import Optional, Any, List, Dict, Union
+from typing import Optional, Any, List, Dict, Union, overload
 import requests
 from scalekit.actions.types import ToolRequest,ExecuteToolResponse,MagicLinkResponse,ListConnectedAccountsResponse,ListToolsResponse,DeleteConnectedAccountResponse,GetConnectedAccountAuthResponse,GetConnectedAccountDetailsResponse,ToolInput, \
     UpdateConnectedAccountResponse,CreateMcpConfigResponse,ListMcpConfigsResponse,UpdateMcpConfigResponse,DeleteMcpConfigResponse, \
@@ -16,6 +16,7 @@ from scalekit.actions.modifier import (
     apply_pre_modifiers, apply_post_modifiers
 )
 from scalekit.common.exceptions import ScalekitNotFoundException
+from scalekit.mcp import _check_connection_token_args
 from scalekit.v1.tools.tools_pb2 import Filter
 from google.protobuf.wrappers_pb2 import BoolValue
 
@@ -328,6 +329,8 @@ class ActionClient:
         identifier: Optional[str] = None,
         provider: Optional[str] = None,
         connection_names: Optional[List[str]] = None,
+        page_size: Optional[int] = None,
+        page_token: Optional[str] = None,
         **kwargs
     ) -> ListConnectedAccountsResponse:
         """List connected accounts with optional filtering.
@@ -341,14 +344,20 @@ class ActionClient:
                 of these connection slugs. Useful when you want to check multiple
                 connectors at once, e.g. ``["github", "google-calendar", "slack"]``.
                 Can be combined with ``identifier`` to narrow results to a specific user.
+            page_size: Maximum number of connected accounts per page (optional).
+            page_token: ``next_page_token`` from a previous response, to fetch the
+                next page (optional).
 
         Returns:
-            ListConnectedAccountsResponse containing the matching connected accounts.
+            ListConnectedAccountsResponse containing the matching connected accounts,
+            with ``next_page_token`` set when more pages remain.
         """
         result_tuple = self.connected_accounts.list_connected_accounts(
             connector=connection_name,
             identifier=identifier,
             provider=provider,
+            page_size=page_size,
+            page_token=page_token,
             connection_names=connection_names,
         )
         return ListConnectedAccountsResponse.from_proto(result_tuple[0])
@@ -1358,63 +1367,140 @@ class ActionMcp:
         )
         return ListMcpConnectedAccountsResponse.from_proto(result_tuple[0])
 
+    @overload
     def create_session_token(
         self,
         mcp_config_id: str,
         identifier: str,
-        expiry: Optional[timedelta] = None,
+        expiry: timedelta | None = None,
+        access_level: str | None = None,
+    ) -> CreateMcpSessionTokenResponse: ...
+
+    @overload
+    def create_session_token(
+        self,
+        *,
+        connection_name: str,
+        identifier: str,
+        expiry: timedelta | None = None,
+        access_level: str | None = None,
+    ) -> CreateMcpSessionTokenResponse: ...
+
+    def create_session_token(
+        self,
+        mcp_config_id: str | None = None,
+        identifier: str | None = None,
+        expiry: timedelta | None = None,
+        access_level: str | None = None,
+        *,
+        connection_name: str | None = None,
     ) -> CreateMcpSessionTokenResponse:
         """Create a short-lived session token for a user to access an MCP server.
 
-        The token is scoped to a specific MCP configuration and end-user. Pass it
-        as a ``Bearer`` token in the ``Authorization`` header when making requests
-        to the MCP server URL associated with the config.
+        Pass exactly one of ``mcp_config_id`` or ``connection_name``; the
+        token works only on the MCP server of that target:
+
+        - ``mcp_config_id``: the MCP configuration's server, at the config's
+          ``mcp_server_url``. It serves the tools the configuration exposes.
+        - ``connection_name``: the connection's own MCP server, at
+          ``<environment_url>/mcp/v3/connections/<connection_name>``. It
+          serves every tool of that connection, with no MCP configuration.
+
+        Send the token as a ``Bearer`` token in the ``Authorization`` header
+        when calling that URL.
 
         Args:
-            mcp_config_id: Scalekit ID of the MCP configuration the token should
-                grant access to, e.g. ``"cfg_01abc123"``.
-            identifier: End-user identifier for whom the token is minted — typically
-                the same email or opaque ID used when calling ``ensure_instance``,
-                e.g. ``"alice@example.com"``.
+            mcp_config_id: Scalekit ID of the MCP configuration the token
+                grants access to, e.g. ``"cfg_01abc123"``.
+            identifier: End-user identifier the token acts as. For a
+                configuration, typically the same email or opaque ID used when
+                calling ``ensure_instance``, e.g. ``"alice@example.com"``; for
+                a connection, the user whose connected account on it is used.
+                1 to 255 characters. Required.
             expiry: Requested lifetime for the token as a Python ``timedelta``.
-                When omitted, the server-side default TTL is applied (typically
-                1 hour). Example values:
+                The server accepts 60 seconds to 24 hours and applies 1 hour
+                when omitted. Fractions of a second are dropped. Example values:
 
                 - ``timedelta(minutes=30)`` — 30-minute token
                 - ``timedelta(hours=8)``    — 8-hour token (work-day session)
                 - ``timedelta(days=1)``     — 24-hour token
+            access_level: Tools the token can use. ``"READ_ONLY"`` limits it to
+                tools annotated read-only: other tools are left out of the tool
+                list and refused when called. ``"FULL"``, or omitting it, exposes
+                every tool of the target. Values are case-sensitive.
+            connection_name: Name of the connection whose MCP server the token
+                grants access to, e.g. ``"gmail"``. Keyword-only. Matched
+                without regard to case, but the server URL path is
+                case-sensitive: connect using the name exactly as stored, e.g.
+                copied from the dashboard.
 
         Returns:
             CreateMcpSessionTokenResponse: Contains:
 
             - ``token`` (``str``) — opaque bearer token string.
-            - ``expires_at`` (``datetime``) — UTC datetime when the token expires.
+            - ``expires_at`` (``datetime``) — naive datetime, in UTC, when the
+              token expires.
 
         Raises:
-            ValueError: If ``mcp_config_id`` or ``identifier`` is blank.
+            ValueError: Raised before any request. Without
+                ``connection_name``: ``mcp_config_id`` or ``identifier`` is
+                empty or missing. With ``connection_name``: ``mcp_config_id``
+                is also given, ``connection_name`` is empty, or ``identifier``
+                is missing or empty.
+            ScalekitNotFoundException: No active connection has
+                ``connection_name``.
+            ScalekitBadRequestException: Any other invalid request, e.g. an
+                invalid ``identifier``, ``expiry`` or ``access_level``, or a
+                connection that is not an AgentKit connection. Depending on
+                the environment's configuration, a connection token also
+                requires ``identifier`` to have an active connected account on
+                the connection; otherwise the server creates a pending
+                connected account for ``identifier`` if it has none on the
+                connection, a token is minted, and the account is reported as
+                not connected when tools are called.
 
         Example::
 
             from datetime import timedelta
 
+            # MCP configuration
             resp = client.actions.mcp.create_session_token(
                 mcp_config_id="cfg_01abc123",
                 identifier="alice@example.com",
                 expiry=timedelta(hours=8),
             )
 
+            # A connection's MCP server, read-only tools for 15 minutes
+            resp = client.actions.mcp.create_session_token(
+                connection_name="gmail",
+                identifier="user_123",
+                expiry=timedelta(minutes=15),
+                access_level="READ_ONLY",
+            )
+
             headers = {"Authorization": f"Bearer {resp.token}"}
             # Use headers when calling the MCP server URL
         """
-        if not mcp_config_id:
-            raise ValueError("mcp_config_id is required")
-        if not identifier:
-            raise ValueError("identifier is required")
-        result_tuple = self._client().create_session_token(
-            mcp_config_id=mcp_config_id,
-            identifier=identifier,
-            expiry=expiry,
-        )
+        if connection_name is None:
+            # Checks and messages unchanged from before connection_name existed.
+            if not mcp_config_id:
+                raise ValueError("mcp_config_id is required")
+            if not identifier:
+                raise ValueError("identifier is required")
+            result_tuple = self._client().create_session_token(
+                mcp_config_id=mcp_config_id,
+                identifier=identifier,
+                expiry=expiry,
+                access_level=access_level,
+            )
+        else:
+            identifier = _check_connection_token_args(mcp_config_id, connection_name, identifier)
+            result_tuple = self._client().create_session_token(
+                connection_name=connection_name,
+                identifier=identifier,
+                expiry=expiry,
+                access_level=access_level,
+            )
         return CreateMcpSessionTokenResponse.from_proto(result_tuple[0])