cai-auth-sdk 0.9.0

Pure-Python client SDK for the CAI-AUTH server (CBOR/HTTP).

cai-auth-sdk (Python)

Pure-Python client SDK for the CAI-AUTH server using HTTP/CBOR. Zero native dependencies — pip installs cleanly on any platform that has Python 3.11+.

Install

# Public PyPI — recommended for external users
pip install cai-auth-sdk

# With Phase 4 forward-secret KEM support
pip install 'cai-auth-sdk[hybrid-kem]'

# From GitLab Package Registry (internal CAI Technology token required)
pip install --index-url \
  https://<user>:<glpat-token>@git.finesynergy.eu/api/v4/projects/87/packages/pypi/simple \
  cai-auth-sdk

# Editable from the monorepo
pip install -e cai-auth-python-sdk

Release channels:

• PyPI public: https://pypi.org/project/cai-auth-sdk/
• GitLab registry: https://git.finesynergy.eu/gelusi/cai-auth/-/packages

Quick start

from cai_auth_sdk import CaiAuthClient

async with CaiAuthClient(base_url="https://cai-auth.example.com") as c:
    ok = await c.health()
    assert ok.status == "ok"

Running tests (Docker only, per project rule)

docker run --rm --name caiauth_python_sdk_test \
  -u $(id -u):$(id -g) \
  -v $(pwd)/..:/work \
  -w /work/cai-auth-python-sdk \
  caiauth/python-sdk-test:latest \
  pytest -v

Scope

Covers all 11 CAI-AUTH protocol endpoints in the 0.2.0 spec:

#	Endpoint	SDK method
1	GET /health	health()
2	GET /metrics	metrics()
3	POST /v1/enroll/begin	enroll_begin()
4	POST /v1/enroll/complete	enroll_complete()
5	POST /v1/challenge/create	challenge_create()
6	POST /v1/challenge/verify	challenge_verify()
7	POST /v1/recovery/begin	recovery_begin()
8	POST /v1/recovery/submit-shard	recovery_submit_shard()
9	POST /v1/recovery/complete	recovery_complete()
10	POST /v1/revoke	revoke()
11	GET /v1/audit	audit()

Limitations

• No certificate pinning (add in Phase 5.1 alongside public deployment).
• No automatic session token refresh — follow server semantics in §5.
• Sync API only for now; async is the primary surface.