nebius.aio.authorization.authorization.Authenticator

class documentation

class Authenticator(ABC): (source)

Known subclasses: nebius.aio.authorization.token.TokenAuthenticator, nebius.aio.channel._RuntimeAuthenticator

Abstract interface for performing per-request authentication.

Subclasses must implement authenticate. They can implement can_retry to permit retries after authentication failures. For example, permit fewer than three retries after an UNAUTHENTICATED code.

The built-in channel calls authenticators on its internal SDK event loop. A custom authenticator must be thread-safe and loop-neutral. It must not retain asyncio state that belongs to an application loop. Thread-local state does not move to the SDK thread; use contextvars.ContextVar when context propagation is required.

Async Method	`authenticate`	Authenticate by modifying the `metadata` before sending an RPC.
Method	`can_retry`	Return whether to call `authenticate` and retry.

@abstractmethod
async def authenticate(self, metadata: Metadata, timeout: float | None = None, options: dict[str, str] | None = None): (source) ¶

overridden in nebius.aio.authorization.token.TokenAuthenticator, nebius.aio.channel._RuntimeAuthenticator

Authenticate by modifying the metadata before sending an RPC.

Parameters
metadata:`nebius.base.metadata.Metadata`	The metadata mapping that will be sent with the RPC. Implementations may mutate this mapping in-place to add or update authentication headers (for example the Authorization header).
timeout:optional `float`	Optional authentication timeout in seconds. Implementations must not exceed this timeout during the whole authentication process.
options:optional `dict[str, str]`	Optional, implementation-specific options passed from the request layer.

@abstractmethod
def can_retry(self, err: Exception, options: dict[str, str] | None = None) -> bool: (source) ¶

overridden in nebius.aio.authorization.token.TokenAuthenticator, nebius.aio.channel._RuntimeAuthenticator

Return whether to call authenticate and retry.

Parameters
err:`Exception`	The exception raised during authentication or while the RPC was in-flight. Implementations inspect the exception to determine if a retry (for example after refreshing a token) is likely to succeed.
options:optional `dict[str, str]`	Optional implementation-specific options.
Returns
bool	`True` when the authentication should be retried, otherwise `False`.