Create client
Create the SDK client and run core auth helpers
Create a ScalekitClient with your environment URL, client ID, and client secret. All other clients hang off this instance.
Store credentials in environment variables. Never hard-code secrets. After you create the client, use Sessions to work with sessions or open a domain client such as Organizations or Users.
get_authorization_url
Section titled “get_authorization_url”#asyncget_authorization_url
Method to get authorization URL
Redirect URI for SAML SSO
Auth URL options object
Authorization URL
import secretsfrom scalekit import AuthorizationUrlOptions
# Security: generate a per-login OAuth state and store it in the session.# Comparing the returned state on callback prevents login CSRF.options = AuthorizationUrlOptions()options.state = secrets.token_urlsafe(32)options.organization_id = 'org_123456'# request.session['oauth_state'] = options.state
auth_url = scalekit_client.get_authorization_url( 'https://yourapp.com/auth/callback', options)# Redirect user to auth_urlauthenticate_with_code
Section titled “authenticate_with_code”#asyncauthenticate_with_code
Method to authenticate with code options
authorization_code
Redirect URI
CodeAuthenticationOptions Object
Tokens and claims.
from scalekit import ScalekitClient
@app.get('/auth/callback')async def auth_callback(request): code = request.query_params.get('code') state = request.query_params.get('state')
# Security: reject the callback if state does not match the session value. if state != request.session.get('oauth_state'): return {'error': 'invalid state'}, 400
result = scalekit_client.authenticate_with_code( code, 'https://yourapp.com/auth/callback' )
request.session['access_token'] = result['access_token'] request.session['user'] = result['user']
return RedirectResponse('/dashboard')get_idp_initiated_login_claims
Section titled “get_idp_initiated_login_claims”#asyncget_idp_initiated_login_claims
Method to get IDP initiated login claims
IDP initiated login token
Optional request settings.
Token audience.
IdpInitiatedLoginClaims
@app.get('/auth/callback')async def auth_callback(request): idp_initiated_login = request.query_params.get('idp_initiated_login')
if idp_initiated_login: claims = scalekit_client.get_idp_initiated_login_claims(idp_initiated_login)
options = AuthorizationUrlOptions() options.connection_id = claims['connection_id'] options.organization_id = claims['organization_id'] options.login_hint = claims.get('login_hint') if claims.get('relay_state'): options.state = claims['relay_state']
auth_url = scalekit_client.get_authorization_url( 'https://yourapp.com/auth/callback', options )
return RedirectResponse(auth_url)validate_access_token
Section titled “validate_access_token”#asyncvalidate_access_token
Method to validate access token
access token
Optional request settings.
Token audience.
bool
is_valid = scalekit_client.validate_access_token(token)if is_valid: # Token is valid, proceed with request passget_logout_url
Section titled “get_logout_url”#asyncget_logout_url
Method to get logout URL
Logout URL options object
str: The logout URL
options = LogoutUrlOptions()options.post_logout_redirect_uri = 'https://example.com'options.state = 'some-state'
logout_url = scalekit_client.get_logout_url(options)verify_webhook_payload
Section titled “verify_webhook_payload”#asyncverify_webhook_payload
Method to verify webhook payload
Secret for webhook verification
Webhook request headers
Webhook payload in str or bytes
bool
import os
@app.post('/webhooks')async def webhook_handler(request): payload = await request.body() headers = dict(request.headers) # Security: load the webhook secret from configuration — never hard-code it. # Skipping signature verification accepts forged webhook payloads as legitimate. secret = os.environ['SCALEKIT_WEBHOOK_SECRET']
is_valid = scalekit_client.verify_webhook_payload(secret, headers, payload)
if not is_valid: return {'error': 'invalid signature'}, 401
# Process verified webhook return {'ok': True}refresh_access_token
Section titled “refresh_access_token”#asyncrefresh_access_token
Method to refresh access token using refresh token
Refresh token to get new access token
dict with access token & refresh token
result = scalekit_client.refresh_access_token(refresh_token)new_access_token = result['access_token']new_refresh_token = result['refresh_token']generate_client_token
Section titled “generate_client_token”#asyncgenerate_client_token
Method to generate access token
Client Id for access token
Client Secret for access token
OAuth scopes.
access token
get_client_access_token
Section titled “get_client_access_token”#asyncget_client_access_token
Method to generate an access token using the stored client credentials.
access token string
validate_access_token_and_get_claims
Section titled “validate_access_token_and_get_claims”#asyncvalidate_access_token_and_get_claims
Method to validate access token and get claims
access token
Optional request settings.
Token audience.
claims
validate_token
Section titled “validate_token”#asyncvalidate_token
Method to validate token
token
Optional request settings.
Optional. audience for validation
payload
verify_scopes
Section titled “verify_scopes”#asyncverify_scopes
Verify that the token contains the required scopes
The token to verify
The scopes that must be present in the token
bool: Returns True if all required scopes are present
verify_interceptor_payload
Section titled “verify_interceptor_payload”#asyncverify_interceptor_payload
Method to verify interceptor payload using common verification logic
Secret for interceptor verification
Headers.
Interceptor payload in str or bytes
bool