Repository navigation
Conversation
kartojal
force-pushed
the
feature/dev-750-python-platform-api-keys
branch
from
October 19, 2026 10:47
b13fd9c to
6d611a9
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #364; review this diff against that branch.
Adds
PlatformApiKeyand exact-endpointRemotePlatformApiKeyadapters for sync and async clients. The proxy receives challenge inputs only; login, refresh and logout remain direct. Restored sessions validate the refreshed bearer/key association before persistence.legacy_api_keypreserves required builder/relayer authorization alongside Platform attribution; migration docs cover the boundary and authenticated, no-store proxy handling.Includes the base-layer logout correction: cached proactive-refresh errors do not prevent bounded revocation with a usable bearer. Expiry recovery and cancellation/refresh races retain cleanup and honest failure reporting; ordinary request retry policy is unchanged.
Validation: 3,313 non-integration tests passed; Ruff lint/format, Pyright and package build passed. David’s Review SDK PR workflow identified expired-restoration validation and callback ordering; these were fixed and tested. No remaining actionable findings.
Draft for manual review. Backend renewal deployment, external CORS/edge access and verified builder/gasless continuity remain release gates. No production end-to-end verification or legacy retirement is claimed.