Python SDK 0.1.0
The published Python package for ACT verification, key helpers and optional web middleware.
openagentid-sdk 0.1.0 is published on PyPI. It requires Python 3.10+ and imports as openagent_sdk. Its required dependencies are cbor2>=5.4 and cryptography>=42; the optional fastapi extra adds FastAPI and Starlette.
Install the exact release with python -m pip install openagentid-sdk==0.1.0. For its web integration, use python -m pip install 'openagentid-sdk[fastapi]==0.1.0' in your application's virtual environment.
This is a separate API from SDK 0.7.2's Node local workspace and browser avatars. The first-agent quickstart runs the Node starter; it is not a Python program. A complete current ACT signing/verification program is available in the Node examples.
Published modules
| Module | Public responsibilities |
|---|---|
act | Verifier, signed envelope/claims, verification builder, size/version/algorithm constants |
scope | Scope.parse and three-segment permission matching |
keys | generate, seed restoration and file/environment helpers |
agent | Agent and Session facade |
middleware | require_act dependency callable and require_act_starlette middleware class |
errors | Typed configuration, encoding, signature, time, audience, issuer and scope errors |
Verifier accepts trusted public keys, expected issuer, expected audience, required scopes and optional timing policy. verify returns verified ActClaims or raises an error. decode_unverified only inspects bytes; it must not authorize an action. Configure trust outside incoming claims and bind the verified result to your tenant/action policy.
Framework integration limits
require_act returns a dependency callable; it does not attach a route guard by itself. The published callback annotates its request as Any, so a FastAPI integration needs a correctly typed application wrapper and Depends wiring. Do not copy the package README's bare dependency-list example as a complete working FastAPI route. require_act_starlette returns an ASGI middleware class. Verify denial behavior and claims propagation in the exact framework version you deploy.
Key restoration
The published keys module uses HKDF-SHA256 when blake3 is absent and attempts blake3.derive_key when it is present. That optional branch must match the installed binding; adding an unrelated dependency can change or break restoration. Preserve your tested dependency set and existing encryption keys. Seed-file helpers store raw seed material, not an encrypted vault. See key management.
The versioned PyPI distribution contains the authoritative Python modules. These docs do not claim the older Python facade implements current Node local-workspace, OATS or live-avatar APIs.