harnest.credentials

All Python modules · Import and compatibility guidance

Exports

Name	Kind
`Credential`	Class
`CredentialContext`	Class
`CredentialError`	Class
`CredentialProvider`	Class
`CredentialProviderError`	Class
`CredentialRequest`	Class
`CredentialUnavailableError`	Class
`credentials`	Namespace

Credential

Opaque material Harnest passes transiently and never serializes. Material may be a token or a framework-native credential value. Harnest keeps either form redacted and requires transport adapters to reveal it at the final outbound security boundary. Obtain this object from the owning Harnest API; its constructor includes runtime bindings.

Example

from harnest.credentials import Credential

credential: Credential  # returned by Harnest, not constructed directly

Credential.reveal

Credential.reveal() -> Any

Return credential material for transport adapters at the security boundary.

Example

from harnest.credentials import Credential

credential: Credential
result = credential.reveal()

CredentialContext

Private invocation capability for resolving outbound credentials. The context deliberately exposes no provider, principal, or resource-map access. Keeping this as a dedicated type lets stage contexts share the invocation lifetime without making credential authority enumerable.

CredentialContext()

Example

from harnest.credentials import CredentialContext

context = CredentialContext()

CredentialContext.resolve

async CredentialContext.resolve(audience: str, scopes: Iterable[str] = ()) -> Credential

Resolve opaque material using only private invocation identity.

Parameters and example

Parameter	Type	Default
`audience`	`str`	Required
`scopes`	`Iterable[str]`	`()`

from harnest.credentials import CredentialContext

context: CredentialContext
credential = await context.resolve(audience=...)

CredentialError

Base class for safe credential-resolution failures.

Example

from harnest.credentials import CredentialError

try:
    ...
except CredentialError as error:
    ...

CredentialProvider

Application-owned source of short-lived invocation credentials.

CredentialProvider()

Example

from harnest.credentials import CredentialProvider

class MyCredentialProvider(CredentialProvider):
    ...

CredentialProvider.start

async CredentialProvider.start() -> None

Initialize provider-owned clients before accepting invocations.

Example

from harnest.credentials import CredentialProvider

provider: CredentialProvider
await provider.start()

CredentialProvider.resolve

async CredentialProvider.resolve(request: CredentialRequest) -> Credential | None

Resolve a credential for one invocation and downstream audience.

Parameters and example

Parameter	Type	Default
`request`	`CredentialRequest`	Required

from harnest.credentials import CredentialProvider

provider: CredentialProvider
credential = await provider.resolve(request=...)

CredentialProvider.close

async CredentialProvider.close() -> None

Release provider-owned clients after invocations have drained.

Example

from harnest.credentials import CredentialProvider

provider: CredentialProvider
await provider.close()

CredentialProviderError

Raised when a configured provider fails or violates its contract.

Example

from harnest.credentials import CredentialProviderError

try:
    ...
except CredentialProviderError as error:
    ...

CredentialRequest

Authenticated principal and authorization scope for one resolution.

CredentialRequest(
    audience: str,
    scopes: tuple[str, ...],
    framework: str,
    agent_name: str,
    invocation_id: str,
    session_id: str,
    principal: AuthPrincipal,
) -> None

Fields (— means no declared default):

Field	Type	Default
`audience`	`str`	`—`
`scopes`	`tuple[str, ...]`	`—`
`framework`	`str`	`—`
`agent_name`	`str`	`—`
`invocation_id`	`str`	`—`
`session_id`	`str`	`—`
`principal`	`AuthPrincipal`	`—`

Parameters and example

Parameter	Type	Default
`audience`	`str`	Required
`scopes`	`tuple[str, ...]`	Required
`framework`	`str`	Required
`agent_name`	`str`	Required
`invocation_id`	`str`	Required
`session_id`	`str`	Required
`principal`	`AuthPrincipal`	Required

from harnest.credentials import CredentialRequest

request = CredentialRequest(
    audience=...,
    scopes=...,
    framework=...,
    agent_name=...,
    invocation_id=...,
    session_id=...,
    principal=...,
)

CredentialUnavailableError

Raised when an invocation cannot obtain a requested credential.

Example

from harnest.credentials import CredentialUnavailableError

try:
    ...
except CredentialUnavailableError as error:
    ...

credentials

Example

from harnest.credentials import credentials

credentials.resolve

async credentials.resolve(audience: str, scopes: Iterable[str] = ()) -> Credential

Resolve opaque material using only private invocation identity.

Parameters and example

Parameter	Type	Default
`audience`	`str`	Required
`scopes`	`Iterable[str]`	`()`

from harnest.credentials import credentials

credential = await credentials.resolve(audience=...)

Overview

Get started

Harnest Studio

Guides

API reference

harnest.credentials

Exports

Credential

Credential.reveal

CredentialContext

CredentialContext.resolve

CredentialError

CredentialProvider

CredentialProvider.start

CredentialProvider.resolve

CredentialProvider.close

CredentialProviderError

CredentialRequest

CredentialUnavailableError

credentials

credentials.resolve

​Exports

​Credential

​Credential.reveal

​CredentialContext

​CredentialContext.resolve

​CredentialError

​CredentialProvider

​CredentialProvider.start

​CredentialProvider.resolve

​CredentialProvider.close

​CredentialProviderError

​CredentialRequest

​CredentialUnavailableError

​credentials

​credentials.resolve

Exports

Credential

Credential.reveal

CredentialContext

CredentialContext.resolve

CredentialError

CredentialProvider

CredentialProvider.start

CredentialProvider.resolve

CredentialProvider.close

CredentialProviderError

CredentialRequest

CredentialUnavailableError

credentials

credentials.resolve