Source: openagent-sdk/sdks/rust/src/credentials.rs. SHA-256: 4031950119cf80c662cc8b3f1862a41b1ac6f38b25b9ef80e899de1c0645c042.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

Module condition:

#[cfg(feature = "arsenal")]

credentials::CredentialClient

Builder-friendly handle to Arsenal-backed credentials for one agent.

CredentialClient is Clone (via Arc) so multiple call sites in an agent can share one underlying broker connection. Internally it holds:

• the [ArsenalClient] (broker connection + identity),
• the agent's default scopes,
• the most-recently issued capability token (cached in the client itself),
• a default audience hint for the broker.

#[cfg(feature = "arsenal")]
#[derive(Clone)]
pub struct CredentialClient {

}

Source line: 39.

credentials::CredentialClient::new

Wrap an existing [ArsenalClient] into a [CredentialClient].

default_scopes are advertised on every capability request unless the caller passes more specific scopes via [Self::request_token].

#[cfg(feature = "arsenal")]
pub fn new(
        client: ArsenalClient,
        default_scopes: Vec<String>,
        default_ttl_seconds: i64,
    ) -> Self;

Source line: 56.

credentials::CredentialClient::default_scopes

Default scopes this credential client was constructed with.

#[cfg(feature = "arsenal")]
pub fn default_scopes(&self) -> &[String];

Source line: 72.

credentials::CredentialClient::ensure_session

Ensure the underlying Arsenal session is open.

Idempotent — safe to call from every entry point. The first call opens the session; subsequent calls are no-ops.

Errors

Returns [OpenAgentError::Credential] if the broker rejects the session.

#[cfg(feature = "arsenal")]
pub async fn ensure_session(&self) -> Result<()>;

Source line: 85.

credentials::CredentialClient::request_token

Request a capability token for the given scopes.

If scopes is empty the client falls back to the default scopes supplied at construction.

Errors

Returns [OpenAgentError::Credential] if the broker rejects the request or no scopes were configured.

#[cfg(feature = "arsenal")]
pub async fn request_token(&self, scopes: &[&str]) -> Result<String>;

Source line: 109.

credentials::CredentialClient::get

Send an HTTP GET through the credential proxy.

url and headers may contain {{VARIABLE}} placeholders; the broker resolves them server-side and the agent never sees the raw credential.

Errors

Returns [OpenAgentError::Credential] or [OpenAgentError::Transport] on broker / network failures.

#[cfg(feature = "arsenal")]
pub async fn get(
        &self,
        url: impl Into<String>,
        headers: BTreeMap<String, String>,
    ) -> Result<ProxyResponse>;

Source line: 144.

credentials::CredentialClient::post

Send an HTTP POST through the credential proxy.

Errors

Returns [OpenAgentError::Credential] or [OpenAgentError::Transport] on broker / network failures.

#[cfg(feature = "arsenal")]
pub async fn post(
        &self,
        url: impl Into<String>,
        headers: BTreeMap<String, String>,
        body: Vec<u8>,
    ) -> Result<ProxyResponse>;

Source line: 158.

credentials::CredentialClient::inner

Reference to the wrapped Arsenal client for advanced use cases.

Drop down to this when the SDK doesn't expose what you need — but if you find yourself doing it often, file a feature request.

#[cfg(feature = "arsenal")]
pub fn inner(&self) -> &ArsenalClient;

Source line: 200.