tai42-identity-redis
The Redis-backed api-key identity provider for the TAI ecosystem — an
installable plugin that registers itself as the "redis" identity provider and
resolves an inbound api key to an authenticated identity.
Importing the package registers the provider in tai42-contract's module-level
identity-provider registry (register_identity_provider("redis", ...)), with no
tai42_app handle involved — so it registers in any process that imports it,
including ones that never start(). A deployment selects it by including
redis in the access-control auth_providers list.
Its only tai-* dependencies are tai42-contract (the identity ABCs and the
registry it registers through) and tai42-kit (the Redis client, the hash typing
seams, and the api-key hash). It never imports the skeleton — the plugin is
contract-facing, and the import is banned by ruff.
The TAI ecosystem
TAI is an open-source runtime for MCP tools, agents, and workflows. An identity provider is how the runtime answers "who is this caller?": it resolves an inbound credential to an authenticated identity, and access control decides what that identity may do. This package is one such provider (api keys over Redis); any package can back the same contract, so this repo is this provider's own full doc home, and the documentation site covers the platform-level story:
- Access-control concept: https://tai42.ai/concepts/access-control
- Build an identity provider (author guide): https://tai42.ai/guides/authors/identity-provider
- Ecosystem catalog: https://tai42.ai/reference/catalog
What it stores
The provider owns the whole api-key identity record in its own plain-Redis storage:
ac:key:{sha256(raw)}— a Redis hash{"user_id", "owner_user_id", "description"}(the identity a raw key resolves to). Every api key belongs to a principal, so every record carries theowner_user_idowner claim.ac:management:key:{user_id}— theuser_id -> hashreverse lookup, so a user id resolves to its stored hash for revoke/edit without a scan.
Key material is never stored — only the SHA-256 hash of the raw key.
Surface
The provider implements tai42_contract.access_control.identity.ApiKeyIdentityProvider:
| Method | Does |
|---|---|
validate_token(token) |
Reads ac:key:{hash} and returns the AuthIdentity, or None for an unknown token. A backend error fails closed by raising; a resolved record carrying no owner claim is an invariant breach and is refused loudly (fail-closed), never resolved. |
provision(user_id, description, *, owner_user_id) |
Mints a raw sk-… key, writes the identity record + reverse lookup in one transaction, and returns the raw key (surfaced once). owner_user_id is required — every api key belongs to a principal — and is stored on the record as the owner claim, so validate_token surfaces it for per-request attenuation. A None/empty owner is a ValueError raised before any write. |
revoke(user_id) |
Deletes the identity record + reverse lookup; False if the user is unknown. |
update_description(user_id, description) |
Rewrites the record's description; False if the user is unknown. A present record carrying no owner claim is refused loudly. |
list_identities() |
SCANs ac:key:* and returns every stored (user_id, description); an enumerated record carrying no owner claim is an invariant breach and is refused loudly. |
healthcheck() |
Probes the provider's OWN Redis storage; raises loudly if the record store is unreachable or broken. |
Requirements
Requires Python 3.13+ and any plain Redis — no modules required. The identity
records are plain Redis hashes, so redis, valkey, or any module-less
redis-server works. An unreachable or broken store is caught loudly by
healthcheck() at startup rather than failing per-request.
Install
Requires Python 3.13+. Install from PyPI into the environment that runs the server:
uv add tai42-identity-redis
Or from source — clone this repo and add it as an editable dependency; the
tai42-* dependencies resolve in-tree from the workspace.
git clone https://github.com/tai42ai/tai42 # next to your app checkout
cd /path/to/your/app
uv add --editable ../tai42/plugins/identity-redis
Development
uv venv --python 3.13
uv pip install --no-sources --editable ".[dev]"
uv run --no-sync ruff check .
uv run --no-sync ruff format --check .
uv run --no-sync pyright
uv run --no-sync pytest --cov --cov-report=term-missing
License
Apache-2.0. See LICENSE and NOTICE.
1 maintainer
Metadata
1 maintainer
Release files for tai42-identity-redis 3.0.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| tai42_identity_redis-3.0.1.tar.gz | 17.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| tai42_identity_redis-3.0.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 33.4 kB
Release files / tai42_identity_redis-3.0.1.tar.gz
| Download URL | tai42_identity_redis-3.0.1.tar.gz |
|---|---|
| Size | 17.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
0b98dbdb3a1b18ad2035c5128753d0f15baba8f4abeff16483eb32a623243e84
|
|
BLAKE2b-256 checksum How to use checksums |
f36e9abc1fb976d21c09d4324af5a301853f7292a7872573eb8397b48af2ad22
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / tai42_identity_redis-3.0.1-py3-none-any.whl
| Download URL | tai42_identity_redis-3.0.1-py3-none-any.whl |
|---|---|
| Size | 16.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
84bc7ba33cdbddd12a825f27ac550181c042fb81e2a1c7fe15ec38d6f0334cf8
|
|
BLAKE2b-256 checksum How to use checksums |
9cfeee90473d892c8d52715171dafd8774805f7ca6f8f483ad673d48ddd19e32
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
