Authentication

Bearer task token

Every task run receives a short-lived JWT in the TASK_JWT environment variable. Pass it as a bearer token on every request to the platform API:

curl "$ALLYBUILD_API_URL/projects/$PROJECT_ID/tasks" \
  -H "Authorization: Bearer $TASK_JWT"

Project scoping

All reads and writes are isolated per project. The client takes the project id explicitly, and the workflow module wires it from PROJECT_ID automatically:

from allybuild_sdk import AllyBuildClient

client = AllyBuildClient(
    base_url=ALLYBUILD_API_URL,   # injected, includes /api
    token=TASK_JWT,               # injected bearer credential
    project_id=PROJECT_ID,        # injected project scope
)

client.configured()   # False when any of the three credentials is missing

LLM gateway credentials

The LLM gateway is OpenAI-compatible and lives at the platform root with a /v1 prefix. Use the same task JWT as the API key:

from openai import OpenAI

gateway = f"{ALLYBUILD_API_URL.removesuffix('/api')}/v1"
llm = OpenAI(base_url=gateway, api_key=TASK_JWT)

Expiration and renewal

Task tokens expire with the task run. Long-running work should read TASK_JWT from the environment at request time instead of hardcoding it, so a retried run picks up its fresh token automatically.

Checklist

• Always send Authorization: Bearer $TASK_JWT — requests without it fail auth
• Scope every path under /projects/$PROJECT_ID — cross-project access is rejected
• Treat ALLYBUILD_API_URL as the single base URL; do not hardcode hosts
• Never persist the token beyond the run — read it from env when needed