validmind 2.13.4__tar.gz → 2.13.5__tar.gz

{validmind-2.13.4 → validmind-2.13.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: validmind
-Version: 2.13.4
+Version: 2.13.5
 Summary: ValidMind Library
 Author-email: Andres Rodriguez <andres@validmind.ai>, Juan Martinez <juan@validmind.ai>, Anil Sorathiya <anil@validmind.ai>, Luis Pallares <luis@validmind.ai>, John Walz <john@validmind.ai>
 License:                          DUAL LICENSE NOTICE
@@ -707,8 +707,10 @@ Requires-Dist: pandas<3.0.0,>=2.0.3
 Requires-Dist: plotly>=6.0.0
 Requires-Dist: polars
 Requires-Dist: python-dotenv
+Requires-Dist: requests<3.0.0,>=2.28.0
 Requires-Dist: scikit-learn
 Requires-Dist: seaborn
+Requires-Dist: segno<2.0.0,>=1.6.6
 Requires-Dist: tabulate<0.10.0,>=0.9.0
 Requires-Dist: tiktoken
 Requires-Dist: tqdm

{validmind-2.13.4 → validmind-2.13.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "validmind"
-version = "2.13.4"
+version = "2.13.5"
 description = "ValidMind Library"
 readme = "README.pypi.md"
 requires-python = ">=3.9,<3.15"
@@ -14,6 +14,7 @@ authors = [
 ]
 dependencies = [
   "aiohttp[speedups] (<3.13.1)",
+  "requests (>=2.28.0,<3.0.0)",
   "ipywidgets",
   "kaleido (>=1.2.0,<2.0.0)",
   "matplotlib",
@@ -33,6 +34,7 @@ dependencies = [
   "tqdm",
   "anywidget",
   "beautifulsoup4",
+  "segno (>=1.6.6,<2.0.0)",
 ]
 
 [project.optional-dependencies]
@@ -122,7 +124,7 @@ pii-detection = [
 
 [dependency-groups]
 dev = [
-  "black>=22.1.0,<23",
+  "black>=22.1.0,<26",
   "click",
   "cython>=0.29.34,<0.30",
   "docstring-parser",

validmind-2.13.5/validmind/__version__.py

@@ -0,0 +1 @@
+__version__ = "2.13.5"

{validmind-2.13.4 → validmind-2.13.5}/validmind/ai/utils.py

@@ -20,7 +20,7 @@ __judge_embeddings = None
 OPENAI_MODEL = "gpt-4.1"
 OPENAI_EMBEDDINGS_MODEL = "text-embedding-3-small"
 GEMINI_MODEL = "gemini-2.5-pro"
-GEMINI_EMBEDDINGS_MODEL = "models/text-embedding-004"
+GEMINI_EMBEDDINGS_MODEL = "gemini-embedding-001"
 
 # can be None, True or False (ternary to represent initial state, ack and failed ack)
 __ack = None
@@ -59,10 +59,7 @@ def _get_configured_provider():
     if os.getenv("AZURE_OPENAI_KEY"):
         return "azure"
 
-    if _get_google_api_key():
-        return "gemini"
-
-    return None
+    return "gemini"
 
 
 def get_client_and_model():
@@ -104,18 +101,12 @@ def get_client_and_model():
 
         logger.debug(f"Using Azure OpenAI {__model} for generating descriptions")
 
-    elif provider == "gemini":
+    else:
         __client = None
         __model = os.getenv("GEMINI_MODEL", GEMINI_MODEL)
 
         logger.debug(f"Using Gemini {__model} for generating descriptions")
 
-    else:
-        raise ValueError(
-            "OPENAI_API_KEY, AZURE_OPENAI_KEY, GOOGLE_API_KEY, or GEMINI_API_KEY "
-            "must be setup to use LLM features"
-        )
-
     return __client, __model
 
 
@@ -202,16 +193,18 @@ def _build_gemini_judge_config(model):
         langchain_google_genai, "GoogleGenerativeAIEmbeddings"
     )
     google_api_key = _get_google_api_key()
+    chat_kwargs = {"model": model}
+    embeddings_kwargs = {
+        "model": os.getenv("GEMINI_EMBEDDINGS_MODEL", GEMINI_EMBEDDINGS_MODEL),
+    }
+
+    if google_api_key:
+        chat_kwargs["api_key"] = google_api_key
+        embeddings_kwargs["google_api_key"] = google_api_key
 
     return (
-        ChatGoogleGenerativeAI(
-            model=model,
-            api_key=google_api_key,
-        ),
-        GoogleGenerativeAIEmbeddings(
-            model=os.getenv("GEMINI_EMBEDDINGS_MODEL", GEMINI_EMBEDDINGS_MODEL),
-            google_api_key=google_api_key,
-        ),
+        ChatGoogleGenerativeAI(**chat_kwargs),
+        GoogleGenerativeAIEmbeddings(**embeddings_kwargs),
     )
 
 
@@ -230,6 +223,80 @@ def _build_openai_judge_config(client, model):
     )
 
 
+def _import_deepeval_base_llm():
+    try:
+        deepeval_base_model = importlib.import_module("deepeval.models.base_model")
+    except ImportError:
+        raise ImportError(
+            "Please run `pip install validmind[llm]` to use Gemini DeepEval scorers"
+        )
+
+    return getattr(deepeval_base_model, "DeepEvalBaseLLM")
+
+
+def _unwrap_deepeval_response(response):
+    return getattr(response, "content", response)
+
+
+def _build_gemini_deepeval_model(model):
+    DeepEvalBaseLLM = _import_deepeval_base_llm()
+    judge_llm, _ = _build_gemini_judge_config(model)
+
+    class GeminiDeepEvalModel(DeepEvalBaseLLM):
+        def __init__(self, chat_model, model_name):
+            self._chat_model = chat_model
+            self._model_name = model_name
+            self.model = self.load_model()
+
+        def load_model(self, *args, **kwargs):
+            return self._chat_model
+
+        def generate(self, prompt: str, schema=None):
+            chat_model = self.load_model()
+            if schema is not None and hasattr(chat_model, "with_structured_output"):
+                response = chat_model.with_structured_output(schema).invoke(prompt)
+            else:
+                response = chat_model.invoke(prompt)
+
+            return _unwrap_deepeval_response(response)
+
+        async def a_generate(self, prompt: str, schema=None):
+            chat_model = self.load_model()
+            if schema is not None and hasattr(chat_model, "with_structured_output"):
+                response = await chat_model.with_structured_output(schema).ainvoke(
+                    prompt
+                )
+            else:
+                response = await chat_model.ainvoke(prompt)
+
+            return _unwrap_deepeval_response(response)
+
+        def get_model_name(self, *args, **kwargs):
+            return self._model_name
+
+    return GeminiDeepEvalModel(judge_llm, model)
+
+
+def run_deepeval_evaluation(*, test_cases, metrics):
+    try:
+        from deepeval import evaluate
+
+        deepeval_test_run = importlib.import_module("deepeval.test_run.test_run")
+    except ImportError:
+        raise ImportError(
+            "Please run `pip install validmind[llm]` to use Gemini DeepEval scorers"
+        )
+
+    original_is_confident = deepeval_test_run.is_confident
+
+    try:
+        # ValidMind scorers should run locally without depending on Confident AI login state.
+        deepeval_test_run.is_confident = lambda: False
+        return evaluate(test_cases=test_cases, metrics=metrics)
+    finally:
+        deepeval_test_run.is_confident = original_is_confident
+
+
 def get_judge_config(judge_llm=None, judge_embeddings=None):
     Embeddings, BaseChatModel, FunctionModel = _import_judge_dependencies()
 
@@ -270,6 +337,10 @@ def get_deepeval_model():
     _, model = get_client_and_model()
 
     if provider == "gemini":
+        google_api_key = _get_google_api_key()
+        if google_api_key is None:
+            return _build_gemini_deepeval_model(model)
+
         try:
             deepeval_models = importlib.import_module("deepeval.models")
         except ImportError:
@@ -280,7 +351,7 @@ def get_deepeval_model():
         GeminiModel = getattr(deepeval_models, "GeminiModel")
         return GeminiModel(
             model=model,
-            api_key=_get_google_api_key(),
+            api_key=google_api_key,
             temperature=0,
         )
 

{validmind-2.13.4 → validmind-2.13.5}/validmind/api_client.py

@@ -21,7 +21,12 @@ from aiohttp import FormData
 
 from .__version__ import __version__
 from .client_config import client_config
-from .errors import MissingAPICredentialsError, MissingModelIdError, raise_api_error
+from .errors import (
+    MissingAPICredentialsError,
+    MissingModelIdError,
+    ValidMindAuthError,
+    raise_api_error,
+)
 from .logging import get_logger, log_api_operation
 from .utils import NumpyEncoder, is_html, md_to_html, run_async
 from .vm_models.figure import Figure
@@ -34,10 +39,30 @@ _api_host = os.getenv("VM_API_HOST")
 _model_cuid = os.getenv("VM_API_MODEL")
 _document = None
 _monitoring = False
+_auth_mode = "api_key"
+_access_token: Optional[str] = None
+_oidc_login_context: Optional[Dict[str, str]] = None
 
 __api_session: Optional[aiohttp.ClientSession] = None
 
 
+def _invalidate_async_session() -> None:
+    """Drop the aiohttp session so the next request picks up new headers."""
+    global __api_session
+    sess = __api_session
+    __api_session = None
+    if sess is None or sess.closed:
+        return
+    try:
+        loop = asyncio.get_running_loop()
+        loop.create_task(sess.close())
+    except RuntimeError:
+        try:
+            asyncio.run(sess.close())
+        except RuntimeError:
+            pass
+
+
 @atexit.register
 def _close_session():
     """Closes the async client session at exit."""
@@ -70,14 +95,21 @@ def get_api_model() -> Optional[str]:
 
 def _get_api_headers() -> Dict[str, str]:
     headers = {
-        "X-API-KEY": _api_key,
-        "X-API-SECRET": _api_secret,
         "X-MODEL-CUID": _model_cuid,
         "X-MONITORING": str(_monitoring),
         "X-LIBRARY-VERSION": __version__,
     }
     if _document:
         headers["X-DOCUMENT-TYPE"] = _document
+    if _auth_mode == "oidc":
+        if not _access_token:
+            raise ValidMindAuthError(
+                "OAuth access token is missing. Run vm.init() again with issuer and client_id."
+            )
+        headers["Authorization"] = f"Bearer {_access_token}"
+    else:
+        headers["X-API-KEY"] = _api_key
+        headers["X-API-SECRET"] = _api_secret
     return headers
 
 
@@ -192,14 +224,71 @@ def _ping() -> Dict[str, Any]:
         )
 
 
+def _obtain_oidc_tokens(
+    issuer: str,
+    client_id: str,
+    scope: str,
+    audience: Optional[str] = None,
+) -> Dict[str, Any]:
+    """Return a credentials entry dict with access_token, expires_at, refresh_token, etc."""
+    from .credentials_store import (
+        delete_cached_entry,
+        get_cached_entry,
+        is_expired,
+        normalize_client_id,
+        normalize_issuer,
+        upsert_cached_entry,
+    )
+    from .oidc_device import run_device_flow, try_refresh_cached_tokens
+
+    norm_issuer = normalize_issuer(issuer)
+    norm_client_id = normalize_client_id(client_id)
+    cached = get_cached_entry(norm_issuer, norm_client_id, audience=audience)
+    if cached and not is_expired(cached):
+        return cached
+    if cached and cached.get("refresh_token"):
+        try:
+            new_tokens = try_refresh_cached_tokens(
+                norm_issuer,
+                norm_client_id,
+                cached["refresh_token"],
+                scope,
+                audience=audience,
+            )
+            upsert_cached_entry(
+                norm_issuer, norm_client_id, new_tokens, audience=audience
+            )
+            return new_tokens
+        except ValidMindAuthError:
+            delete_cached_entry(norm_issuer, norm_client_id, audience=audience)
+    tokens = run_device_flow(norm_issuer, norm_client_id, scope, audience=audience)
+    upsert_cached_entry(norm_issuer, norm_client_id, tokens, audience=audience)
+    return tokens
+
+
+def _is_entra_issuer(issuer: str) -> bool:
+    return "login.microsoftonline.com" in issuer.lower()
+
+
+def _select_oidc_bearer_token(entry: Dict[str, Any]) -> str:
+    if _is_entra_issuer(entry.get("issuer", "")) and entry.get("id_token"):
+        return entry["id_token"]
+    return entry["access_token"]
+
+
 def init(
     api_key: Optional[str] = None,
     api_secret: Optional[str] = None,
     api_host: Optional[str] = None,
+    api_url: Optional[str] = None,
     model: Optional[str] = None,
     monitoring: bool = False,
     generate_descriptions: Optional[bool] = None,
     document: Optional[str] = None,
+    issuer: Optional[str] = None,
+    client_id: Optional[str] = None,
+    scope: Optional[str] = None,
+    audience: Optional[str] = None,
 ):
     """
     Initializes the API client instances and calls the /ping endpoint to ensure
@@ -208,36 +297,82 @@ def init(
     If the API key and secret are not provided, the client will attempt to
     retrieve them from the environment variables `VM_API_KEY` and `VM_API_SECRET`.
 
+    Alternatively, pass ``issuer`` and ``client_id`` or set their ``VM_OIDC_*``
+    environment variables to authenticate via the OIDC device authorization flow
+    (RFC 8628). Tokens are cached under ``~/.validmind/credentials.json``. Do not
+    combine API keys with OIDC parameters.
+
     Args:
         model (str, optional): The model CUID. Defaults to None.
         api_key (str, optional): The API key. Defaults to None.
         api_secret (str, optional): The API secret. Defaults to None.
-        api_host (str, optional): The API host. Defaults to None.
+        api_host (str, optional): The API host (tracking base URL). Defaults to
+            env ``VM_API_HOST`` or ``VM_API_URL``.
+        api_url (str, optional): Alias for ``api_host``. Defaults to env
+            ``VM_API_URL`` or ``VM_API_HOST``.
         monitoring (bool): The ongoing monitoring flag. Defaults to False.
         generate_descriptions (bool, optional): Whether to use GenAI to generate test result descriptions. Defaults to True.
         document (str, optional): The name of the document. Omitting this argument is deprecated.
+        issuer (str, optional): OIDC issuer URL (e.g. Entra tenant ``.../v2.0``).
+            Can be set via env ``VM_OIDC_ISSUER``.
+        client_id (str, optional): OAuth public client id for device flow. Can be
+            set via env ``VM_OIDC_CLIENT_ID``.
+        scope (str, optional): OAuth scopes (default ``openid profile email``).
+            Can be set via env ``VM_OIDC_SCOPE``.
+        audience (str, optional): Resource / API identifier for the access token
+            (e.g. Auth0 API Identifier). Use the same value the ValidMind backend
+            expects as ``api_audience`` so the provider can issue RS256 API tokens.
+            Can be set via env ``VM_OIDC_AUDIENCE``.
+
     Raises:
-        ValueError: If the API key and secret are not provided
+        MissingAPICredentialsError: If neither API keys nor OIDC parameters can be resolved.
+        MissingModelIdError: If model id is missing.
+        ValidMindAuthError: If OIDC configuration conflicts or login fails.
     """
     global _api_key, _api_secret, _api_host, _model_cuid, _monitoring, _document
+    global _auth_mode, _access_token, _oidc_login_context
 
     if api_key == "...":
         # special case to detect when running a notebook placeholder (...)
         # will override with environment variables for easier local development
-        api_host = api_key = api_secret = model = None
+        api_host = api_url = api_key = api_secret = model = issuer = client_id = (
+            audience
+        ) = None
 
     _model_cuid = model or os.getenv("VM_API_MODEL")
     if _model_cuid is None:
         raise MissingModelIdError()
 
-    _api_key = api_key or os.getenv("VM_API_KEY")
-    _api_secret = api_secret or os.getenv("VM_API_SECRET")
-    if _api_key is None or _api_secret is None:
-        raise MissingAPICredentialsError()
-
-    _api_host = api_host or os.getenv(
-        "VM_API_HOST", "http://localhost:5000/api/v1/tracking/"
+    resolved_host = (
+        api_url
+        or api_host
+        or os.getenv("VM_API_URL")
+        or os.getenv("VM_API_HOST", "http://localhost:5000/api/v1/tracking/")
+    )
+    oidc_issuer = issuer if issuer is not None else os.getenv("VM_OIDC_ISSUER")
+    oidc_client_id = (
+        client_id if client_id is not None else os.getenv("VM_OIDC_CLIENT_ID")
+    )
+    oidc_scope = scope if scope is not None else os.getenv("VM_OIDC_SCOPE")
+
+    env_key = api_key if api_key is not None else os.getenv("VM_API_KEY")
+    env_secret = api_secret if api_secret is not None else os.getenv("VM_API_SECRET")
+    has_api_creds = (
+        env_key is not None
+        and env_secret is not None
+        and env_key != ""
+        and env_secret != ""
     )
+    has_oidc = bool(oidc_issuer and oidc_client_id)
+    if has_oidc and has_api_creds:
+        raise ValidMindAuthError(
+            "Provide either API credentials (api_key and api_secret) or OIDC "
+            "(issuer and client_id), not both."
+        )
+    if oidc_issuer and not oidc_client_id:
+        raise ValidMindAuthError("client_id is required when issuer is set.")
+    if oidc_client_id and not oidc_issuer:
+        raise ValidMindAuthError("issuer is required when client_id is set.")
 
     _monitoring = monitoring
 
@@ -251,6 +386,41 @@ def init(
         )
 
     _document = document
+
+    if has_oidc:
+        _auth_mode = "oidc"
+        _api_key = None
+        _api_secret = None
+        _api_host = resolved_host
+        scope_val = oidc_scope or "openid profile email"
+        from .credentials_store import normalize_audience
+
+        oidc_audience_val = normalize_audience(
+            audience if audience is not None else os.getenv("VM_OIDC_AUDIENCE")
+        )
+        oidc_audience_opt = oidc_audience_val or None
+        entry = _obtain_oidc_tokens(
+            oidc_issuer, oidc_client_id, scope_val, audience=oidc_audience_opt
+        )
+        _access_token = _select_oidc_bearer_token(entry)
+        _oidc_login_context = {
+            "issuer": entry["issuer"],
+            "client_id": entry["client_id"],
+            "scope": scope_val,
+            "audience": entry.get("audience") or oidc_audience_val,
+        }
+        _invalidate_async_session()
+    else:
+        if env_key is None or env_secret is None:
+            raise MissingAPICredentialsError()
+        _auth_mode = "api_key"
+        _access_token = None
+        _oidc_login_context = None
+        _api_key = env_key
+        _api_secret = env_secret
+        _api_host = resolved_host
+        _invalidate_async_session()
+
     reload()
 
 

validmind-2.13.5/validmind/credentials_store.py

@@ -0,0 +1,179 @@
+# Copyright © 2023-2026 ValidMind Inc. All rights reserved.
+# Refer to the LICENSE file in the root of this repository for details.
+# SPDX-License-Identifier: AGPL-3.0 AND ValidMind Commercial
+
+"""Persist OIDC tokens for library authentication under ``~/.validmind/``."""
+
+from __future__ import annotations
+
+import json
+import os
+import tempfile
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+from .errors import ValidMindAuthError
+
+_CREDENTIALS_VERSION = 1
+
+
+def normalize_issuer(issuer: str) -> str:
+    """Strip whitespace, trailing slash, and matching outer quotes.
+
+    Surrounding quotes often appear when copying from ``.env`` or notebooks
+    (e.g. ``'https://idp.example.com'``), which would otherwise break HTTP clients.
+    """
+    base = issuer.strip().rstrip("/")
+    while len(base) >= 2 and base[0] == base[-1] and base[0] in ('"', "'"):
+        base = base[1:-1].strip().rstrip("/")
+    return base
+
+
+def normalize_client_id(client_id: str) -> str:
+    """Strip whitespace and matching outer quotes from OAuth ``client_id``."""
+    base = client_id.strip()
+    while len(base) >= 2 and base[0] == base[-1] and base[0] in ('"', "'"):
+        base = base[1:-1].strip()
+    return base
+
+
+def normalize_audience(audience: Optional[str]) -> str:
+    """Normalize OAuth resource/API ``audience`` (Identifier). Empty if unset."""
+    if not audience:
+        return ""
+    base = audience.strip()
+    while len(base) >= 2 and base[0] == base[-1] and base[0] in ('"', "'"):
+        base = base[1:-1].strip()
+    return base
+
+
+def credential_key(issuer: str, client_id: str, audience: Optional[str] = None) -> str:
+    base = f"{normalize_issuer(issuer)}|{normalize_client_id(client_id)}"
+    aud = normalize_audience(audience)
+    if aud:
+        return f"{base}|{aud}"
+    return base
+
+
+def credentials_path() -> Path:
+    return Path.home() / ".validmind" / "credentials.json"
+
+
+def _empty_store() -> Dict[str, Any]:
+    return {"version": _CREDENTIALS_VERSION, "credentials": {}}
+
+
+def load_credentials_file(path: Optional[Path] = None) -> Dict[str, Any]:
+    path = path or credentials_path()
+    if not path.is_file():
+        return _empty_store()
+    try:
+        with open(path, encoding="utf-8") as f:
+            data = json.load(f)
+    except (json.JSONDecodeError, OSError) as e:
+        raise ValidMindAuthError(f"Could not read credentials file {path}: {e}") from e
+    if not isinstance(data, dict):
+        raise ValidMindAuthError(f"Invalid credentials file format at {path}")
+    data.setdefault("version", _CREDENTIALS_VERSION)
+    data.setdefault("credentials", {})
+    return data
+
+
+def _atomic_write(path: Path, payload: Dict[str, Any]) -> None:
+    path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(
+        dir=str(path.parent), prefix=".credentials-", suffix=".tmp", text=True
+    )
+    tmp_path = Path(tmp)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            json.dump(payload, handle, indent=2)
+        os.chmod(tmp_path, 0o600)
+        os.replace(tmp_path, path)
+    except Exception:
+        try:
+            tmp_path.unlink()
+        except OSError:
+            pass
+        raise
+
+
+def save_credentials_file(data: Dict[str, Any], path: Optional[Path] = None) -> None:
+    path = path or credentials_path()
+    data = dict(data)
+    data["version"] = _CREDENTIALS_VERSION
+    if "credentials" not in data or not isinstance(data["credentials"], dict):
+        data["credentials"] = {}
+    _atomic_write(path, data)
+
+
+def get_cached_entry(
+    issuer: str,
+    client_id: str,
+    path: Optional[Path] = None,
+    audience: Optional[str] = None,
+) -> Optional[Dict[str, Any]]:
+    key = credential_key(issuer, client_id, audience)
+    data = load_credentials_file(path)
+    entry = data.get("credentials", {}).get(key)
+    if not entry:
+        return None
+    return dict(entry)
+
+
+def upsert_cached_entry(
+    issuer: str,
+    client_id: str,
+    entry: Dict[str, Any],
+    path: Optional[Path] = None,
+    audience: Optional[str] = None,
+) -> None:
+    key = credential_key(issuer, client_id, audience)
+    norm_issuer = normalize_issuer(issuer)
+    aud = normalize_audience(audience)
+    data = load_credentials_file(path)
+    credentials = dict(data.get("credentials", {}))
+    row = {
+        "issuer": norm_issuer,
+        "client_id": client_id,
+        **entry,
+    }
+    if aud:
+        row["audience"] = aud
+    credentials[key] = row
+    data["credentials"] = credentials
+    save_credentials_file(data, path)
+
+
+def delete_cached_entry(
+    issuer: str,
+    client_id: str,
+    path: Optional[Path] = None,
+    audience: Optional[str] = None,
+) -> None:
+    key = credential_key(issuer, client_id, audience)
+    data = load_credentials_file(path)
+    credentials = dict(data.get("credentials", {}))
+    credentials.pop(key, None)
+    data["credentials"] = credentials
+    save_credentials_file(data, path)
+
+
+def is_expired(entry: Dict[str, Any], skew_seconds: int = 120) -> bool:
+    raw = entry.get("expires_at")
+    if not raw:
+        return True
+    try:
+        expires = datetime.fromisoformat(raw.replace("Z", "+00:00"))
+    except ValueError:
+        return True
+    if expires.tzinfo is None:
+        expires = expires.replace(tzinfo=timezone.utc)
+    return datetime.now(timezone.utc) >= expires - timedelta(seconds=skew_seconds)
+
+
+def expires_at_from_secs(expires_in: Optional[int]) -> str:
+    seconds = int(expires_in) if expires_in is not None else 3600
+    when = datetime.now(timezone.utc) + timedelta(seconds=seconds)
+    return when.isoformat()