authsec-langchain-sdk 0.1.0

AuthSec identity, delegation, and CIBA approval for LangChain agents

authsec-langchain

AuthSec identity, delegation, and human-in-the-loop approval for LangChain agents.

What this gives you

• Delegation tokens — short-lived JWTs scoped to a single agent run, fetched from AuthSec
• Cloud credential exchange — trade the delegation JWT for AWS STS / Azure AD / GCP IAM credentials, so the agent never holds long-lived cloud keys
• CIBA approval — pause the agent and require a human tap-to-approve before a high-risk tool runs
• LangChain callback — drop-in handler that surfaces the current delegation token to every tool invocation

The SDK only consumes the AuthSec HTTP API. No AuthSec server changes are required.

Install

pip install authsec-langchain

Quick start

from authsec_langchain import AuthsecClient, AuthsecConfig, AuthsecCallbackHandler

client = AuthsecClient(AuthsecConfig(
    base_url="https://auth.example.com",
    api_token="<agent-bootstrap-jwt>",
    tenant_id="tenant-123",
))

# Get a delegation JWT
token = client.get_delegation_token()

# Trade it for AWS credentials
aws_creds = client.exchange_cloud_credentials(
    "aws",
    audience="sts.amazonaws.com",
    role_arn="arn:aws:iam::123456789012:role/my-agent-role",
)

# Ask the user to approve a high-risk action
approved_jwt = client.request_approval(
    login_hint="[e-mail]",
    binding_message="Allow agent to delete production resources?",
)

See examples/aws_s3_agent.py for an end-to-end LangChain agent.

What's in v0.1

Feature	Status
Delegation-token fetch + cache	✅
AWS / Azure / GCP cloud exchange	✅
CIBA initiate + poll	✅
LangChain callback handler	✅
Async client	⏳ v0.2
LangGraph node helpers	⏳ v0.2
Streaming approval (webhook)	⏳ v0.3

Development

pip install -e ".[dev]"
pytest