validmind 2.13.4__tar.gz → 2.13.6__tar.gz

{validmind-2.13.4 → validmind-2.13.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: validmind
-Version: 2.13.4
+Version: 2.13.6
 Summary: ValidMind Library
 Author-email: Andres Rodriguez <andres@validmind.ai>, Juan Martinez <juan@validmind.ai>, Anil Sorathiya <anil@validmind.ai>, Luis Pallares <luis@validmind.ai>, John Walz <john@validmind.ai>
 License:                          DUAL LICENSE NOTICE
@@ -707,8 +707,10 @@ Requires-Dist: pandas<3.0.0,>=2.0.3
 Requires-Dist: plotly>=6.0.0
 Requires-Dist: polars
 Requires-Dist: python-dotenv
+Requires-Dist: requests<3.0.0,>=2.28.0
 Requires-Dist: scikit-learn
 Requires-Dist: seaborn
+Requires-Dist: segno<2.0.0,>=1.6.6
 Requires-Dist: tabulate<0.10.0,>=0.9.0
 Requires-Dist: tiktoken
 Requires-Dist: tqdm
@@ -724,7 +726,9 @@ Requires-Dist: langchain-google-genai; extra == 'all'
 Requires-Dist: langchain-openai>=0.1.8; extra == 'all'
 Requires-Dist: langchain<0.4.0,>=0.2.0; extra == 'all'
 Requires-Dist: langdetect; extra == 'all'
+Requires-Dist: llvmlite<0.48,>=0.47.0; (python_version >= '3.14') and extra == 'all'
 Requires-Dist: nltk<4.0.0,>=3.8.1; extra == 'all'
+Requires-Dist: numba>=0.65.1; (python_version >= '3.14') and extra == 'all'
 Requires-Dist: pyarrow<16; (python_version < '3.13') and extra == 'all'
 Requires-Dist: pyarrow<21,>=20; (python_version == '3.13') and extra == 'all'
 Requires-Dist: pyarrow<23,>=22; (python_version >= '3.14') and extra == 'all'
@@ -751,6 +755,8 @@ Requires-Dist: pyarrow<16; (python_version < '3.13') and extra == 'datasets'
 Requires-Dist: pyarrow<21,>=20; (python_version == '3.13') and extra == 'datasets'
 Requires-Dist: pyarrow<23,>=22; (python_version >= '3.14') and extra == 'datasets'
 Provides-Extra: explainability
+Requires-Dist: llvmlite<0.48,>=0.47.0; (python_version >= '3.14') and extra == 'explainability'
+Requires-Dist: numba>=0.65.1; (python_version >= '3.14') and extra == 'explainability'
 Requires-Dist: shap>=0.46.0; extra == 'explainability'
 Provides-Extra: huggingface
 Requires-Dist: sentencepiece<0.3.0,>=0.2.0; extra == 'huggingface'

{validmind-2.13.4 → validmind-2.13.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "validmind"
-version = "2.13.4"
+version = "2.13.6"
 description = "ValidMind Library"
 readme = "README.pypi.md"
 requires-python = ">=3.9,<3.15"
@@ -14,6 +14,7 @@ authors = [
 ]
 dependencies = [
   "aiohttp[speedups] (<3.13.1)",
+  "requests (>=2.28.0,<3.0.0)",
   "ipywidgets",
   "kaleido (>=1.2.0,<2.0.0)",
   "matplotlib",
@@ -33,6 +34,7 @@ dependencies = [
   "tqdm",
   "anywidget",
   "beautifulsoup4",
+  "segno (>=1.6.6,<2.0.0)",
 ]
 
 [project.optional-dependencies]
@@ -63,6 +65,8 @@ all = [
   "pyarrow (>=22,<23) ; python_version >= '3.14'",
   "arch (>=7.0.0)",
   "shap (>=0.46.0)",
+  "numba (>=0.65.1) ; python_version >= '3.14'",
+  "llvmlite (>=0.47.0,<0.48) ; python_version >= '3.14'",
   "scorecardpy==0.1.9.6",
   "setuptools (<82)",
 ]
@@ -105,7 +109,11 @@ nlp = [
 pytorch = ["torch (>=2.0.0)"]
 stats = ["scipy", "statsmodels (>=0.14.2,<0.15.0)", "arch (>=7.0.0)"]
 xgboost = ["xgboost (>=1.5.2,<3)"]
-explainability = ["shap (>=0.46.0)"]
+explainability = [
+  "shap (>=0.46.0)",
+  "numba (>=0.65.1) ; python_version >= '3.14'",
+  "llvmlite (>=0.47.0,<0.48) ; python_version >= '3.14'",
+]
 credit_risk = ["scorecardpy==0.1.9.6", "setuptools (<82)"]
 datasets = [
   "datasets (>=2.10.0,<3.0.0) ; python_version < '3.14'",
@@ -122,7 +130,7 @@ pii-detection = [
 
 [dependency-groups]
 dev = [
-  "black>=22.1.0,<23",
+  "black>=22.1.0,<26",
   "click",
   "cython>=0.29.34,<0.30",
   "docstring-parser",

validmind-2.13.6/validmind/__version__.py

@@ -0,0 +1 @@
+__version__ = "2.13.6"

{validmind-2.13.4 → validmind-2.13.6}/validmind/ai/utils.py

@@ -17,10 +17,11 @@ __client = None
 __model = None
 __judge_llm = None
 __judge_embeddings = None
+__judge_llm_explicitly_set = False
 OPENAI_MODEL = "gpt-4.1"
 OPENAI_EMBEDDINGS_MODEL = "text-embedding-3-small"
 GEMINI_MODEL = "gemini-2.5-pro"
-GEMINI_EMBEDDINGS_MODEL = "models/text-embedding-004"
+GEMINI_EMBEDDINGS_MODEL = "gemini-embedding-001"
 
 # can be None, True or False (ternary to represent initial state, ack and failed ack)
 __ack = None
@@ -59,10 +60,7 @@ def _get_configured_provider():
     if os.getenv("AZURE_OPENAI_KEY"):
         return "azure"
 
-    if _get_google_api_key():
-        return "gemini"
-
-    return None
+    return "gemini"
 
 
 def get_client_and_model():
@@ -104,18 +102,12 @@ def get_client_and_model():
 
         logger.debug(f"Using Azure OpenAI {__model} for generating descriptions")
 
-    elif provider == "gemini":
+    else:
         __client = None
         __model = os.getenv("GEMINI_MODEL", GEMINI_MODEL)
 
         logger.debug(f"Using Gemini {__model} for generating descriptions")
 
-    else:
-        raise ValueError(
-            "OPENAI_API_KEY, AZURE_OPENAI_KEY, GOOGLE_API_KEY, or GEMINI_API_KEY "
-            "must be setup to use LLM features"
-        )
-
     return __client, __model
 
 
@@ -202,16 +194,18 @@ def _build_gemini_judge_config(model):
         langchain_google_genai, "GoogleGenerativeAIEmbeddings"
     )
     google_api_key = _get_google_api_key()
+    chat_kwargs = {"model": model}
+    embeddings_kwargs = {
+        "model": os.getenv("GEMINI_EMBEDDINGS_MODEL", GEMINI_EMBEDDINGS_MODEL),
+    }
+
+    if google_api_key:
+        chat_kwargs["api_key"] = google_api_key
+        embeddings_kwargs["google_api_key"] = google_api_key
 
     return (
-        ChatGoogleGenerativeAI(
-            model=model,
-            api_key=google_api_key,
-        ),
-        GoogleGenerativeAIEmbeddings(
-            model=os.getenv("GEMINI_EMBEDDINGS_MODEL", GEMINI_EMBEDDINGS_MODEL),
-            google_api_key=google_api_key,
-        ),
+        ChatGoogleGenerativeAI(**chat_kwargs),
+        GoogleGenerativeAIEmbeddings(**embeddings_kwargs),
     )
 
 
@@ -230,6 +224,162 @@ def _build_openai_judge_config(client, model):
     )
 
 
+def _import_deepeval_base_llm():
+    try:
+        deepeval_base_model = importlib.import_module("deepeval.models.base_model")
+    except ImportError:
+        raise ImportError(
+            "Please run `pip install validmind[llm]` to use Gemini DeepEval scorers"
+        )
+
+    return getattr(deepeval_base_model, "DeepEvalBaseLLM")
+
+
+def _unwrap_deepeval_response(response):
+    return getattr(response, "content", response)
+
+
+def _is_reason_only_schema(schema):
+    """True when ``schema`` is a single-field ``{reason}`` explanation schema.
+
+    DeepEval's ``*ScoreReason`` schemas carry only the human-readable explanation
+    and do not affect the metric score, so a missing value can be degraded safely.
+    """
+    fields = getattr(schema, "model_fields", None) or getattr(
+        schema, "__fields__", None
+    )
+    try:
+        return set(fields.keys()) == {"reason"}
+    except Exception:
+        return False
+
+
+def _require_structured_response(result, schema):
+    """Guard against a judge LLM returning no parseable structured output.
+
+    Gemini's default function-calling path yields ``None`` when the model
+    response contains no tool call. Returning that ``None`` to DeepEval surfaces
+    as a cryptic ``'NoneType' object has no attribute 'reason'``.
+
+    For reason-only schemas the metric score is already computed from earlier
+    verdict calls, so a missing explanation is cosmetic: degrade to a placeholder
+    reason and keep the score. Score-bearing schemas (statements, verdicts) are
+    never faked -- doing so would yield a silently wrong score -- so those raise.
+    """
+    if result is not None:
+        return result
+
+    schema_name = getattr(schema, "__name__", schema)
+
+    if _is_reason_only_schema(schema):
+        logger.warning(
+            "Judge LLM returned no structured output for %s; recording the score "
+            "with an empty explanation.",
+            schema_name,
+        )
+        return schema(reason="N/A (judge LLM returned no explanation)")
+
+    raise ValueError(
+        f"Judge LLM returned no parseable structured output for {schema_name}. "
+        "This usually means the model produced no tool call for the requested "
+        "schema. Try a different judge model, or check provider quotas and "
+        "safety settings."
+    )
+
+
+def _structured_generate(chat_model, prompt, schema):
+    """Invoke ``chat_model`` for structured output, retrying via json_mode.
+
+    Gemini's default function-calling path can return ``None`` when the model
+    emits no tool call; json_mode binds a response schema and is deterministic.
+    """
+    result = chat_model.with_structured_output(schema).invoke(prompt)
+    if result is None:
+        try:
+            result = chat_model.with_structured_output(
+                schema, method="json_mode"
+            ).invoke(prompt)
+        except Exception:
+            pass
+    return _require_structured_response(result, schema)
+
+
+async def _a_structured_generate(chat_model, prompt, schema):
+    """Async counterpart of :func:`_structured_generate`."""
+    result = await chat_model.with_structured_output(schema).ainvoke(prompt)
+    if result is None:
+        try:
+            result = await chat_model.with_structured_output(
+                schema, method="json_mode"
+            ).ainvoke(prompt)
+        except Exception:
+            pass
+    return _require_structured_response(result, schema)
+
+
+def _build_langchain_deepeval_model(chat_model):
+    """Wrap any LangChain BaseChatModel as a DeepEval-compatible model.
+
+    Used when set_judge_config() has been called so that DeepEval scorers
+    honour the same judge model as prompt-validation and RAGAS tests.
+    """
+    DeepEvalBaseLLM = _import_deepeval_base_llm()
+
+    class LangChainDeepEvalModel(DeepEvalBaseLLM):
+        def __init__(self, model):
+            self._chat_model = model
+            self.model = self.load_model()
+
+        def load_model(self, *args, **kwargs):
+            return self._chat_model
+
+        def generate(self, prompt: str, schema=None):
+            chat_model = self.load_model()
+            if schema is not None and hasattr(chat_model, "with_structured_output"):
+                return _structured_generate(chat_model, prompt, schema)
+            return _unwrap_deepeval_response(chat_model.invoke(prompt))
+
+        async def a_generate(self, prompt: str, schema=None):
+            chat_model = self.load_model()
+            if schema is not None and hasattr(chat_model, "with_structured_output"):
+                return await _a_structured_generate(chat_model, prompt, schema)
+            return _unwrap_deepeval_response(await chat_model.ainvoke(prompt))
+
+        def get_model_name(self, *args, **kwargs):
+            for attr in ("model", "model_name", "azure_deployment"):
+                val = getattr(self._chat_model, attr, None)
+                if val:
+                    return val
+            return type(self._chat_model).__name__
+
+    return LangChainDeepEvalModel(chat_model)
+
+
+def _build_gemini_deepeval_model(model):
+    judge_llm, _ = _build_gemini_judge_config(model)
+    return _build_langchain_deepeval_model(judge_llm)
+
+
+def run_deepeval_evaluation(*, test_cases, metrics):
+    try:
+        from deepeval import evaluate
+
+        deepeval_test_run = importlib.import_module("deepeval.test_run.test_run")
+    except ImportError:
+        raise ImportError(
+            "Please run `pip install validmind[llm]` to use Gemini DeepEval scorers"
+        )
+
+    original_is_confident = deepeval_test_run.is_confident
+
+    try:
+        # ValidMind scorers should run locally without depending on Confident AI login state.
+        deepeval_test_run.is_confident = lambda: False
+        return evaluate(test_cases=test_cases, metrics=metrics)
+    finally:
+        deepeval_test_run.is_confident = original_is_confident
+
+
 def get_judge_config(judge_llm=None, judge_embeddings=None):
     Embeddings, BaseChatModel, FunctionModel = _import_judge_dependencies()
 
@@ -265,11 +415,21 @@ def get_deepeval_model():
     OpenAI/Azure scorers currently pass a model string. Gemini support requires a
     native DeepEval model object so the provider can be configured correctly.
     """
+    if (
+        __judge_llm_explicitly_set
+        and __judge_llm is not None
+        and __judge_embeddings is not None
+    ):
+        return _build_langchain_deepeval_model(__judge_llm)
 
     provider = _get_configured_provider()
     _, model = get_client_and_model()
 
     if provider == "gemini":
+        google_api_key = _get_google_api_key()
+        if google_api_key is None:
+            return _build_gemini_deepeval_model(model)
+
         try:
             deepeval_models = importlib.import_module("deepeval.models")
         except ImportError:
@@ -280,7 +440,7 @@ def get_deepeval_model():
         GeminiModel = getattr(deepeval_models, "GeminiModel")
         return GeminiModel(
             model=model,
-            api_key=_get_google_api_key(),
+            api_key=google_api_key,
             temperature=0,
         )
 
@@ -288,7 +448,7 @@ def get_deepeval_model():
 
 
 def set_judge_config(judge_llm, judge_embeddings):
-    global __judge_llm, __judge_embeddings
+    global __judge_llm, __judge_embeddings, __judge_llm_explicitly_set
     try:
         from langchain_core.embeddings import Embeddings
         from langchain_core.language_models.chat_models import BaseChatModel
@@ -301,12 +461,13 @@ def set_judge_config(judge_llm, judge_embeddings):
     ):
         __judge_llm = judge_llm
         __judge_embeddings = judge_embeddings
-        # Assuming 'your_object' is the object you want to check
+        __judge_llm_explicitly_set = True
     elif isinstance(judge_llm, FunctionModel) and isinstance(
         judge_embeddings, FunctionModel
     ):
         __judge_llm = judge_llm.model
         __judge_embeddings = judge_embeddings.model
+        __judge_llm_explicitly_set = True
     else:
         raise ValueError(
             "Provided Judge LLM/Embeddings are not Langchain compatible. Ensure the judge LLM/embedding provided are an instance of "

{validmind-2.13.4 → validmind-2.13.6}/validmind/api_client.py

@@ -21,7 +21,12 @@ from aiohttp import FormData
 
 from .__version__ import __version__
 from .client_config import client_config
-from .errors import MissingAPICredentialsError, MissingModelIdError, raise_api_error
+from .errors import (
+    MissingAPICredentialsError,
+    MissingModelIdError,
+    ValidMindAuthError,
+    raise_api_error,
+)
 from .logging import get_logger, log_api_operation
 from .utils import NumpyEncoder, is_html, md_to_html, run_async
 from .vm_models.figure import Figure
@@ -34,10 +39,30 @@ _api_host = os.getenv("VM_API_HOST")
 _model_cuid = os.getenv("VM_API_MODEL")
 _document = None
 _monitoring = False
+_auth_mode = "api_key"
+_access_token: Optional[str] = None
+_oidc_login_context: Optional[Dict[str, str]] = None
 
 __api_session: Optional[aiohttp.ClientSession] = None
 
 
+def _invalidate_async_session() -> None:
+    """Drop the aiohttp session so the next request picks up new headers."""
+    global __api_session
+    sess = __api_session
+    __api_session = None
+    if sess is None or sess.closed:
+        return
+    try:
+        loop = asyncio.get_running_loop()
+        loop.create_task(sess.close())
+    except RuntimeError:
+        try:
+            asyncio.run(sess.close())
+        except RuntimeError:
+            pass
+
+
 @atexit.register
 def _close_session():
     """Closes the async client session at exit."""
@@ -70,14 +95,21 @@ def get_api_model() -> Optional[str]:
 
 def _get_api_headers() -> Dict[str, str]:
     headers = {
-        "X-API-KEY": _api_key,
-        "X-API-SECRET": _api_secret,
         "X-MODEL-CUID": _model_cuid,
         "X-MONITORING": str(_monitoring),
         "X-LIBRARY-VERSION": __version__,
     }
     if _document:
         headers["X-DOCUMENT-TYPE"] = _document
+    if _auth_mode == "oidc":
+        if not _access_token:
+            raise ValidMindAuthError(
+                "OAuth access token is missing. Run vm.init() again with issuer and client_id."
+            )
+        headers["Authorization"] = f"Bearer {_access_token}"
+    else:
+        headers["X-API-KEY"] = _api_key
+        headers["X-API-SECRET"] = _api_secret
     return headers
 
 
@@ -192,14 +224,71 @@ def _ping() -> Dict[str, Any]:
         )
 
 
+def _obtain_oidc_tokens(
+    issuer: str,
+    client_id: str,
+    scope: str,
+    audience: Optional[str] = None,
+) -> Dict[str, Any]:
+    """Return a credentials entry dict with access_token, expires_at, refresh_token, etc."""
+    from .credentials_store import (
+        delete_cached_entry,
+        get_cached_entry,
+        is_expired,
+        normalize_client_id,
+        normalize_issuer,
+        upsert_cached_entry,
+    )
+    from .oidc_device import run_device_flow, try_refresh_cached_tokens
+
+    norm_issuer = normalize_issuer(issuer)
+    norm_client_id = normalize_client_id(client_id)
+    cached = get_cached_entry(norm_issuer, norm_client_id, audience=audience)
+    if cached and not is_expired(cached):
+        return cached
+    if cached and cached.get("refresh_token"):
+        try:
+            new_tokens = try_refresh_cached_tokens(
+                norm_issuer,
+                norm_client_id,
+                cached["refresh_token"],
+                scope,
+                audience=audience,
+            )
+            upsert_cached_entry(
+                norm_issuer, norm_client_id, new_tokens, audience=audience
+            )
+            return new_tokens
+        except ValidMindAuthError:
+            delete_cached_entry(norm_issuer, norm_client_id, audience=audience)
+    tokens = run_device_flow(norm_issuer, norm_client_id, scope, audience=audience)
+    upsert_cached_entry(norm_issuer, norm_client_id, tokens, audience=audience)
+    return tokens
+
+
+def _is_entra_issuer(issuer: str) -> bool:
+    return "login.microsoftonline.com" in issuer.lower()
+
+
+def _select_oidc_bearer_token(entry: Dict[str, Any]) -> str:
+    if _is_entra_issuer(entry.get("issuer", "")) and entry.get("id_token"):
+        return entry["id_token"]
+    return entry["access_token"]
+
+
 def init(
     api_key: Optional[str] = None,
     api_secret: Optional[str] = None,
     api_host: Optional[str] = None,
+    api_url: Optional[str] = None,
     model: Optional[str] = None,
     monitoring: bool = False,
     generate_descriptions: Optional[bool] = None,
     document: Optional[str] = None,
+    issuer: Optional[str] = None,
+    client_id: Optional[str] = None,
+    scope: Optional[str] = None,
+    audience: Optional[str] = None,
 ):
     """
     Initializes the API client instances and calls the /ping endpoint to ensure
@@ -208,36 +297,82 @@ def init(
     If the API key and secret are not provided, the client will attempt to
     retrieve them from the environment variables `VM_API_KEY` and `VM_API_SECRET`.
 
+    Alternatively, pass ``issuer`` and ``client_id`` or set their ``VM_OIDC_*``
+    environment variables to authenticate via the OIDC device authorization flow
+    (RFC 8628). Tokens are cached under ``~/.validmind/credentials.json``. Do not
+    combine API keys with OIDC parameters.
+
     Args:
         model (str, optional): The model CUID. Defaults to None.
         api_key (str, optional): The API key. Defaults to None.
         api_secret (str, optional): The API secret. Defaults to None.
-        api_host (str, optional): The API host. Defaults to None.
+        api_host (str, optional): The API host (tracking base URL). Defaults to
+            env ``VM_API_HOST`` or ``VM_API_URL``.
+        api_url (str, optional): Alias for ``api_host``. Defaults to env
+            ``VM_API_URL`` or ``VM_API_HOST``.
         monitoring (bool): The ongoing monitoring flag. Defaults to False.
         generate_descriptions (bool, optional): Whether to use GenAI to generate test result descriptions. Defaults to True.
         document (str, optional): The name of the document. Omitting this argument is deprecated.
+        issuer (str, optional): OIDC issuer URL (e.g. Entra tenant ``.../v2.0``).
+            Can be set via env ``VM_OIDC_ISSUER``.
+        client_id (str, optional): OAuth public client id for device flow. Can be
+            set via env ``VM_OIDC_CLIENT_ID``.
+        scope (str, optional): OAuth scopes (default ``openid profile email``).
+            Can be set via env ``VM_OIDC_SCOPE``.
+        audience (str, optional): Resource / API identifier for the access token
+            (e.g. Auth0 API Identifier). Use the same value the ValidMind backend
+            expects as ``api_audience`` so the provider can issue RS256 API tokens.
+            Can be set via env ``VM_OIDC_AUDIENCE``.
+
     Raises:
-        ValueError: If the API key and secret are not provided
+        MissingAPICredentialsError: If neither API keys nor OIDC parameters can be resolved.
+        MissingModelIdError: If model id is missing.
+        ValidMindAuthError: If OIDC configuration conflicts or login fails.
     """
     global _api_key, _api_secret, _api_host, _model_cuid, _monitoring, _document
+    global _auth_mode, _access_token, _oidc_login_context
 
     if api_key == "...":
         # special case to detect when running a notebook placeholder (...)
         # will override with environment variables for easier local development
-        api_host = api_key = api_secret = model = None
+        api_host = api_url = api_key = api_secret = model = issuer = client_id = (
+            audience
+        ) = None
 
     _model_cuid = model or os.getenv("VM_API_MODEL")
     if _model_cuid is None:
         raise MissingModelIdError()
 
-    _api_key = api_key or os.getenv("VM_API_KEY")
-    _api_secret = api_secret or os.getenv("VM_API_SECRET")
-    if _api_key is None or _api_secret is None:
-        raise MissingAPICredentialsError()
-
-    _api_host = api_host or os.getenv(
-        "VM_API_HOST", "http://localhost:5000/api/v1/tracking/"
+    resolved_host = (
+        api_url
+        or api_host
+        or os.getenv("VM_API_URL")
+        or os.getenv("VM_API_HOST", "http://localhost:5000/api/v1/tracking/")
+    )
+    oidc_issuer = issuer if issuer is not None else os.getenv("VM_OIDC_ISSUER")
+    oidc_client_id = (
+        client_id if client_id is not None else os.getenv("VM_OIDC_CLIENT_ID")
+    )
+    oidc_scope = scope if scope is not None else os.getenv("VM_OIDC_SCOPE")
+
+    env_key = api_key if api_key is not None else os.getenv("VM_API_KEY")
+    env_secret = api_secret if api_secret is not None else os.getenv("VM_API_SECRET")
+    has_api_creds = (
+        env_key is not None
+        and env_secret is not None
+        and env_key != ""
+        and env_secret != ""
     )
+    has_oidc = bool(oidc_issuer and oidc_client_id)
+    if has_oidc and has_api_creds:
+        raise ValidMindAuthError(
+            "Provide either API credentials (api_key and api_secret) or OIDC "
+            "(issuer and client_id), not both."
+        )
+    if oidc_issuer and not oidc_client_id:
+        raise ValidMindAuthError("client_id is required when issuer is set.")
+    if oidc_client_id and not oidc_issuer:
+        raise ValidMindAuthError("issuer is required when client_id is set.")
 
     _monitoring = monitoring
 
@@ -251,6 +386,41 @@ def init(
         )
 
     _document = document
+
+    if has_oidc:
+        _auth_mode = "oidc"
+        _api_key = None
+        _api_secret = None
+        _api_host = resolved_host
+        scope_val = oidc_scope or "openid profile email"
+        from .credentials_store import normalize_audience
+
+        oidc_audience_val = normalize_audience(
+            audience if audience is not None else os.getenv("VM_OIDC_AUDIENCE")
+        )
+        oidc_audience_opt = oidc_audience_val or None
+        entry = _obtain_oidc_tokens(
+            oidc_issuer, oidc_client_id, scope_val, audience=oidc_audience_opt
+        )
+        _access_token = _select_oidc_bearer_token(entry)
+        _oidc_login_context = {
+            "issuer": entry["issuer"],
+            "client_id": entry["client_id"],
+            "scope": scope_val,
+            "audience": entry.get("audience") or oidc_audience_val,
+        }
+        _invalidate_async_session()
+    else:
+        if env_key is None or env_secret is None:
+            raise MissingAPICredentialsError()
+        _auth_mode = "api_key"
+        _access_token = None
+        _oidc_login_context = None
+        _api_key = env_key
+        _api_secret = env_secret
+        _api_host = resolved_host
+        _invalidate_async_session()
+
     reload()