scalekit-sdk-python 2.20.0__tar.gz → 2.21.0__tar.gz

{scalekit_sdk_python-2.20.0 → scalekit_sdk_python-2.21.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scalekit-sdk-python
-Version: 2.20.0
+Version: 2.21.0
 Summary: Scalekit official Python SDK
 Home-page: https://github.com/scalekit-inc/scalekit-sdk-python
 Author: Team Scalekit
@@ -60,7 +60,7 @@ Dynamic: summary
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Python versions](https://img.shields.io/pypi/pyversions/scalekit-sdk-python.svg?style=flat-square)](https://pypi.org/project/scalekit-sdk-python/)
 
-<a href="https://scalekit.com" target="_blank" rel="noopener noreferrer">Scalekit</a> is the **auth stack for AI apps** - from human authentication to agent authorization. Build secure AI products faster with authentication for humans (SSO, passwordless, full-stack auth) and agents (MCP/APIs, delegated actions), all unified on one platform. This Python SDK enables both traditional B2B authentication and cutting-edge agentic workflows.
+<a href="https://scalekit.com" target="_blank" rel="noopener noreferrer">Scalekit</a> provides auth and actions on behalf of users, with 500+ connectors and 20,000+ tools. Build secure AI products faster with authentication for humans (SSO, passwordless, full-stack auth) and agents (MCP/APIs, delegated actions), all unified on one platform. This Python SDK enables both traditional B2B authentication and cutting-edge agentic workflows.
 
 ## 🤖 Agent-First Features
 

{scalekit_sdk_python-2.20.0 → scalekit_sdk_python-2.21.0}/README.md

@@ -13,7 +13,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Python versions](https://img.shields.io/pypi/pyversions/scalekit-sdk-python.svg?style=flat-square)](https://pypi.org/project/scalekit-sdk-python/)
 
-<a href="https://scalekit.com" target="_blank" rel="noopener noreferrer">Scalekit</a> is the **auth stack for AI apps** - from human authentication to agent authorization. Build secure AI products faster with authentication for humans (SSO, passwordless, full-stack auth) and agents (MCP/APIs, delegated actions), all unified on one platform. This Python SDK enables both traditional B2B authentication and cutting-edge agentic workflows.
+<a href="https://scalekit.com" target="_blank" rel="noopener noreferrer">Scalekit</a> provides auth and actions on behalf of users, with 500+ connectors and 20,000+ tools. Build secure AI products faster with authentication for humans (SSO, passwordless, full-stack auth) and agents (MCP/APIs, delegated actions), all unified on one platform. This Python SDK enables both traditional B2B authentication and cutting-edge agentic workflows.
 
 ## 🤖 Agent-First Features
 

{scalekit_sdk_python-2.20.0 → scalekit_sdk_python-2.21.0}/scalekit/_version.py

@@ -1,3 +1,3 @@
 # Single source of truth for the SDK version.
 # Import this in setup.py and scalekit/core.py — never hardcode the version elsewhere.
-__version__ = "2.20.0"
+__version__ = "2.21.0"

{scalekit_sdk_python-2.20.0 → scalekit_sdk_python-2.21.0}/scalekit/actions/actions.py

@@ -1,5 +1,5 @@
 from datetime import timedelta
-from typing import Optional, Any, List, Dict, Union
+from typing import Optional, Any, List, Dict, Union, overload
 import requests
 from scalekit.actions.types import ToolRequest,ExecuteToolResponse,MagicLinkResponse,ListConnectedAccountsResponse,ListToolsResponse,DeleteConnectedAccountResponse,GetConnectedAccountAuthResponse,GetConnectedAccountDetailsResponse,ToolInput, \
     UpdateConnectedAccountResponse,CreateMcpConfigResponse,ListMcpConfigsResponse,UpdateMcpConfigResponse,DeleteMcpConfigResponse, \
@@ -16,6 +16,7 @@ from scalekit.actions.modifier import (
     apply_pre_modifiers, apply_post_modifiers
 )
 from scalekit.common.exceptions import ScalekitNotFoundException
+from scalekit.mcp import _check_connection_token_args
 from scalekit.v1.tools.tools_pb2 import Filter
 from google.protobuf.wrappers_pb2 import BoolValue
 
@@ -1366,63 +1367,140 @@ class ActionMcp:
         )
         return ListMcpConnectedAccountsResponse.from_proto(result_tuple[0])
 
+    @overload
     def create_session_token(
         self,
         mcp_config_id: str,
         identifier: str,
-        expiry: Optional[timedelta] = None,
+        expiry: timedelta | None = None,
+        access_level: str | None = None,
+    ) -> CreateMcpSessionTokenResponse: ...
+
+    @overload
+    def create_session_token(
+        self,
+        *,
+        connection_name: str,
+        identifier: str,
+        expiry: timedelta | None = None,
+        access_level: str | None = None,
+    ) -> CreateMcpSessionTokenResponse: ...
+
+    def create_session_token(
+        self,
+        mcp_config_id: str | None = None,
+        identifier: str | None = None,
+        expiry: timedelta | None = None,
+        access_level: str | None = None,
+        *,
+        connection_name: str | None = None,
     ) -> CreateMcpSessionTokenResponse:
         """Create a short-lived session token for a user to access an MCP server.
 
-        The token is scoped to a specific MCP configuration and end-user. Pass it
-        as a ``Bearer`` token in the ``Authorization`` header when making requests
-        to the MCP server URL associated with the config.
+        Pass exactly one of ``mcp_config_id`` or ``connection_name``; the
+        token works only on the MCP server of that target:
+
+        - ``mcp_config_id``: the MCP configuration's server, at the config's
+          ``mcp_server_url``. It serves the tools the configuration exposes.
+        - ``connection_name``: the connection's own MCP server, at
+          ``<environment_url>/mcp/v3/connections/<connection_name>``. It
+          serves every tool of that connection, with no MCP configuration.
+
+        Send the token as a ``Bearer`` token in the ``Authorization`` header
+        when calling that URL.
 
         Args:
-            mcp_config_id: Scalekit ID of the MCP configuration the token should
-                grant access to, e.g. ``"cfg_01abc123"``.
-            identifier: End-user identifier for whom the token is minted — typically
-                the same email or opaque ID used when calling ``ensure_instance``,
-                e.g. ``"alice@example.com"``.
+            mcp_config_id: Scalekit ID of the MCP configuration the token
+                grants access to, e.g. ``"cfg_01abc123"``.
+            identifier: End-user identifier the token acts as. For a
+                configuration, typically the same email or opaque ID used when
+                calling ``ensure_instance``, e.g. ``"alice@example.com"``; for
+                a connection, the user whose connected account on it is used.
+                1 to 255 characters. Required.
             expiry: Requested lifetime for the token as a Python ``timedelta``.
-                When omitted, the server-side default TTL is applied (typically
-                1 hour). Example values:
+                The server accepts 60 seconds to 24 hours and applies 1 hour
+                when omitted. Fractions of a second are dropped. Example values:
 
                 - ``timedelta(minutes=30)`` — 30-minute token
                 - ``timedelta(hours=8)``    — 8-hour token (work-day session)
                 - ``timedelta(days=1)``     — 24-hour token
+            access_level: Tools the token can use. ``"READ_ONLY"`` limits it to
+                tools annotated read-only: other tools are left out of the tool
+                list and refused when called. ``"FULL"``, or omitting it, exposes
+                every tool of the target. Values are case-sensitive.
+            connection_name: Name of the connection whose MCP server the token
+                grants access to, e.g. ``"gmail"``. Keyword-only. Matched
+                without regard to case, but the server URL path is
+                case-sensitive: connect using the name exactly as stored, e.g.
+                copied from the dashboard.
 
         Returns:
             CreateMcpSessionTokenResponse: Contains:
 
             - ``token`` (``str``) — opaque bearer token string.
-            - ``expires_at`` (``datetime``) — UTC datetime when the token expires.
+            - ``expires_at`` (``datetime``) — naive datetime, in UTC, when the
+              token expires.
 
         Raises:
-            ValueError: If ``mcp_config_id`` or ``identifier`` is blank.
+            ValueError: Raised before any request. Without
+                ``connection_name``: ``mcp_config_id`` or ``identifier`` is
+                empty or missing. With ``connection_name``: ``mcp_config_id``
+                is also given, ``connection_name`` is empty, or ``identifier``
+                is missing or empty.
+            ScalekitNotFoundException: No active connection has
+                ``connection_name``.
+            ScalekitBadRequestException: Any other invalid request, e.g. an
+                invalid ``identifier``, ``expiry`` or ``access_level``, or a
+                connection that is not an AgentKit connection. Depending on
+                the environment's configuration, a connection token also
+                requires ``identifier`` to have an active connected account on
+                the connection; otherwise the server creates a pending
+                connected account for ``identifier`` if it has none on the
+                connection, a token is minted, and the account is reported as
+                not connected when tools are called.
 
         Example::
 
             from datetime import timedelta
 
+            # MCP configuration
             resp = client.actions.mcp.create_session_token(
                 mcp_config_id="cfg_01abc123",
                 identifier="alice@example.com",
                 expiry=timedelta(hours=8),
             )
 
+            # A connection's MCP server, read-only tools for 15 minutes
+            resp = client.actions.mcp.create_session_token(
+                connection_name="gmail",
+                identifier="user_123",
+                expiry=timedelta(minutes=15),
+                access_level="READ_ONLY",
+            )
+
             headers = {"Authorization": f"Bearer {resp.token}"}
             # Use headers when calling the MCP server URL
         """
-        if not mcp_config_id:
-            raise ValueError("mcp_config_id is required")
-        if not identifier:
-            raise ValueError("identifier is required")
-        result_tuple = self._client().create_session_token(
-            mcp_config_id=mcp_config_id,
-            identifier=identifier,
-            expiry=expiry,
-        )
+        if connection_name is None:
+            # Checks and messages unchanged from before connection_name existed.
+            if not mcp_config_id:
+                raise ValueError("mcp_config_id is required")
+            if not identifier:
+                raise ValueError("identifier is required")
+            result_tuple = self._client().create_session_token(
+                mcp_config_id=mcp_config_id,
+                identifier=identifier,
+                expiry=expiry,
+                access_level=access_level,
+            )
+        else:
+            identifier = _check_connection_token_args(mcp_config_id, connection_name, identifier)
+            result_tuple = self._client().create_session_token(
+                connection_name=connection_name,
+                identifier=identifier,
+                expiry=expiry,
+                access_level=access_level,
+            )
         return CreateMcpSessionTokenResponse.from_proto(result_tuple[0])
 
 

{scalekit_sdk_python-2.20.0 → scalekit_sdk_python-2.21.0}/scalekit/core.py

@@ -187,7 +187,7 @@ class CoreClient:
 
     sdk_version = f"Scalekit-Python/{_sdk_version}"
     # YYYYMMDD
-    api_version = "20260922"
+    api_version = "20261012"
     user_agent = f"{sdk_version} Python/{platform.python_version()} ({platform.system()}; {platform.architecture()}"
 
     def __init__(

{scalekit_sdk_python-2.20.0 → scalekit_sdk_python-2.21.0}/scalekit/mcp.py

@@ -1,6 +1,8 @@
+import enum
 from datetime import timedelta
-from typing import Optional, List
+from typing import List, Optional, overload
 
+import grpc
 from google.protobuf.duration_pb2 import Duration
 
 from scalekit.core import CoreClient
@@ -8,6 +10,44 @@ from scalekit.v1.mcp.mcp_pb2 import *
 from scalekit.v1.mcp.mcp_pb2_grpc import McpServiceStub
 
 
+class _Unset(enum.Enum):
+    """Type of ``_UNSET``: marks an argument the caller did not pass."""
+
+    UNSET = enum.auto()
+
+
+_UNSET = _Unset.UNSET
+
+
+def _check_connection_token_args(
+    mcp_config_id: str | None | _Unset,
+    connection_name: str,
+    identifier: str | None,
+) -> str:
+    """Check the arguments of a connection session token before any request.
+
+    Only the connection form is checked here: the MCP configuration form keeps
+    the checks each facade had before ``connection_name`` existed.
+
+    Returns:
+        The identifier, known to be non-empty.
+
+    Raises:
+        ValueError: ``mcp_config_id`` is also given, ``connection_name`` is
+            empty, or ``identifier`` is missing or empty.
+    """
+    if mcp_config_id is not _UNSET and mcp_config_id is not None:
+        raise ValueError(
+            "Pass either mcp_config_id or connection_name, not both: a session token "
+            "is for one MCP configuration or for one connection's MCP server"
+        )
+    if not connection_name:
+        raise ValueError("connection_name must not be empty")
+    if not identifier:
+        raise ValueError("identifier is required")
+    return identifier
+
+
 class McpClient:
     """Class definition for MCP Client"""
 
@@ -282,32 +322,130 @@ class McpClient:
             request,
         )
 
+    @overload
     def create_session_token(
         self,
         mcp_config_id: str,
         identifier: str,
-        expiry: Optional[timedelta] = None,
-    ) -> CreateMcpSessionTokenResponse:
-        """
-        Create a short-lived session token for a user to authenticate against an MCP server.
+        expiry: timedelta | None = None,
+        access_level: str | None = None,
+    ) -> tuple[CreateMcpSessionTokenResponse, grpc.Call]: ...
 
-        :param mcp_config_id  : ID of the MCP configuration the session token is scoped to
-        :type                 : ``` str ```
-        :param identifier     : End-user identifier (e.g. email or opaque user ID) for whom
-                                the token is being minted
-        :type                 : ``` str ```
-        :param expiry         : Lifetime of the token as a Python ``timedelta``. When omitted,
-                                the server-side default TTL is applied.
-                                Example: ``timedelta(hours=1)``
-        :type                 : ``` timedelta ```
+    @overload
+    def create_session_token(
+        self,
+        *,
+        connection_name: str,
+        identifier: str,
+        expiry: timedelta | None = None,
+        access_level: str | None = None,
+    ) -> tuple[CreateMcpSessionTokenResponse, grpc.Call]: ...
 
-        :returns:
-            CreateMcpSessionTokenResponse — contains ``token`` (str) and ``expires_at`` (Timestamp)
+    def create_session_token(
+        self,
+        mcp_config_id: str | None | _Unset = _UNSET,
+        identifier: str | None = None,
+        expiry: timedelta | None = None,
+        access_level: str | None = None,
+        *,
+        connection_name: str | None = None,
+    ) -> tuple[CreateMcpSessionTokenResponse, grpc.Call]:
+        """Create a short-lived session token for a user to access an MCP server.
+
+        Pass exactly one of ``mcp_config_id`` or ``connection_name``; the
+        token works only on the MCP server of that target:
+
+        - ``mcp_config_id``: the MCP configuration's server, at the config's
+          ``mcp_server_url``. It serves the tools the configuration exposes.
+        - ``connection_name``: the connection's own MCP server, at
+          ``<environment_url>/mcp/v3/connections/<connection_name>``. It
+          serves every tool of that connection, with no MCP configuration.
+
+        Send the token as a ``Bearer`` token in the ``Authorization`` header
+        when calling that URL.
+
+        Args:
+            mcp_config_id: ID of the MCP configuration the token grants access
+                to, e.g. ``"cfg_01abc123"``.
+            identifier: End-user identifier the token acts as, e.g.
+                ``"user_123"``: the user of the configuration's instance, or
+                the user whose connected account on the connection is used.
+                1 to 255 characters. Required.
+            expiry: Lifetime of the token. The server accepts 60 seconds to
+                24 hours and applies 1 hour when omitted. Fractions of a
+                second are dropped.
+            access_level: Tools the token can use. ``"READ_ONLY"`` limits it
+                to tools annotated read-only: other tools are left out of the
+                tool list and refused when called. ``"FULL"``, or omitting it,
+                exposes every tool of the target. Values are case-sensitive.
+            connection_name: Name of the connection whose MCP server the token
+                grants access to, e.g. ``"gmail"``. Keyword-only. Matched
+                without regard to case, but the server URL path is
+                case-sensitive: connect using the name exactly as stored, e.g.
+                copied from the dashboard.
+
+        Returns:
+            The ``(response, call)`` tuple, like the other methods of this
+            client. ``response.token`` is the bearer token and
+            ``response.expires_at`` (Timestamp) is when it expires.
+
+        Raises:
+            ValueError: Raised before any request when neither
+                ``mcp_config_id`` nor ``connection_name`` is passed, or, with
+                ``connection_name``: ``mcp_config_id`` is also given,
+                ``connection_name`` is empty, or ``identifier`` is missing or
+                empty. With ``mcp_config_id``, the arguments are sent as given
+                and the server validates them.
+            ScalekitNotFoundException: No active connection has
+                ``connection_name``.
+            ScalekitBadRequestException: Any other invalid request, e.g. an
+                invalid ``identifier``, ``expiry`` or ``access_level``, or a
+                connection that is not an AgentKit connection. Depending on
+                the environment's configuration, a connection token also
+                requires ``identifier`` to have an active connected account on
+                the connection; otherwise the server creates a pending
+                connected account for ``identifier`` if it has none on the
+                connection, a token is minted, and the account is reported as
+                not connected when tools are called.
+
+        Example::
+
+            from datetime import timedelta
+
+            # MCP configuration
+            response, _ = client.mcp.create_session_token("cfg_01abc123", "user_123")
+
+            # A connection's MCP server, read-only tools for 15 minutes
+            response, _ = client.mcp.create_session_token(
+                connection_name="gmail",
+                identifier="user_123",
+                expiry=timedelta(minutes=15),
+                access_level="READ_ONLY",
+            )
+            headers = {"Authorization": f"Bearer {response.token}"}
         """
-        request = CreateMcpSessionTokenRequest(
-            mcp_config_id=mcp_config_id,
-            identifier=identifier,
-        )
+        if connection_name is not None:
+            identifier = _check_connection_token_args(mcp_config_id, connection_name, identifier)
+            request = CreateMcpSessionTokenRequest(key_id=connection_name, identifier=identifier)
+        elif mcp_config_id is _UNSET:
+            raise ValueError("Either mcp_config_id or connection_name is required")
+        else:
+            # Built exactly as before connection_name existed: the server
+            # validates the configuration ID and identifier.
+            request = CreateMcpSessionTokenRequest(
+                mcp_config_id=mcp_config_id, identifier=identifier
+            )
+        return self._mint_session_token(request, expiry, access_level)
+
+    def _mint_session_token(
+        self,
+        request: CreateMcpSessionTokenRequest,
+        expiry: timedelta | None,
+        access_level: str | None,
+    ) -> tuple[CreateMcpSessionTokenResponse, grpc.Call]:
+        """Set the optional fields shared by both session-token targets and send the request."""
+        if access_level is not None:
+            request.access_level = access_level
         if expiry is not None:
             duration = Duration()
             total_seconds = int(expiry.total_seconds())