API tokens and the SDK

Scripts, agents and CI reach the platform with an API token. The Python SDK, platform_sdk, sends it for you.

Sign-in modes

The platform's PLATFORM_AUTH setting decides who can call it:

PLATFORM_ADMIN_TOKEN bootstraps the first admin in token mode. With oidc, set PLATFORM_OIDC_ISSUER, PLATFORM_OIDC_CLIENT_ID and PLATFORM_OIDC_AUDIENCE; the web app signs in with PKCE.

Roles

Roles, lowest to highest:

A person's role comes from their membership, if an admin set one, else from the identity provider's groups through PLATFORM_OIDC_ROLE_MAP (for example platform-admins=admin), else member.

Create a token

Admins create tokens on the Team page, or through the API. Tokens start with spt_, belong to a team and carry a role. The secret is shown once, when the token is created: copy it then.

curl -X POST "$PLATFORM_URL/v0/tokens" \
  -H "Authorization: Bearer $PLATFORM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "ci", "role": "member"}'

List them with GET /v0/tokens and revoke one with DELETE /v0/tokens/{token_id}.

Use a token from Python

Pass the token to connect, or set PLATFORM_TOKEN (and PLATFORM_TEAM in managed mode) and leave it out:

import platform_sdk

with platform_sdk.connect("cartpole", url="https://platform.example.com", token="spt_...") as env:
    obs, info = env.reset(seed=0)
    obs, reward, terminated, truncated, info = env.step(env.action_space.sample())

Every request then carries Authorization: Bearer spt_.... The same header works with curl and any HTTP client.

Usage and quotas

Admins see usage on the Usage page: instance-hours per environment, with a CSV export for invoicing. Quotas limit each team's concurrent sessions, GPU sessions and instance-hours a month, and are checked when a session starts.