tai42-identity-redis
The Redis-backed api-key identity provider for the TAI ecosystem — an
installable plugin that registers itself as the "redis" identity provider and
resolves an inbound api key to an authenticated identity.
Importing the package registers the provider in tai42-kit's module-level
identity-provider registry (tai42_kit.access_control.registry,
register_identity_provider("redis", ...)), with no
tai42_app handle involved — so it registers in any process that imports it,
including ones that never start(). A deployment selects it by including
redis in the access-control auth_providers list.
Its only tai-* dependencies are tai42-contract (the identity ABCs) and
tai42-kit (the registry it registers through, the Redis client, the hash typing
seams, and the api-key hash). It never imports the skeleton — the plugin is
contract-facing, and the import is banned by ruff.
The TAI ecosystem
TAI is an open-source runtime for MCP tools, agents, and workflows. An identity provider is how the runtime answers "who is this caller?": it resolves an inbound credential to an authenticated identity, and access control decides what that identity may do. This package is one such provider (api keys over Redis); any package can back the same contract, so this repo is this provider's own full doc home, and the documentation site covers the platform-level story:
- Access-control concept: https://tai42.ai/concepts/access-control
- Build an identity provider (author guide): https://tai42.ai/guides/authors/identity-provider
- Ecosystem catalog: https://tai42.ai/reference/catalog
What it stores
The provider owns the whole api-key identity record in its own plain-Redis storage:
ac:key:{sha256(raw)}— a Redis hash{"user_id", "owner_user_id", "description"}(the identity a raw key resolves to). Every api key belongs to a principal, so every record carries theowner_user_idowner claim.ac:management:key:{user_id}— theuser_id -> hashreverse lookup, so a user id resolves to its stored hash for revoke/edit without a scan.
Key material is never stored — only the SHA-256 hash of the raw key.
Surface
The provider implements tai42_contract.access_control.identity.ApiKeyIdentityProvider:
| Method | Does |
|---|---|
validate_token(token) |
Reads ac:key:{hash} and returns the AuthIdentity, or None for an unknown token. A backend error fails closed by raising; a resolved record carrying no owner claim is an invariant breach and is refused loudly (fail-closed), never resolved. |
provision(user_id, description, *, owner_user_id) |
Mints a raw sk-… key, writes the identity record + reverse lookup in one transaction, and returns the raw key (surfaced once). owner_user_id is required — every api key belongs to a principal — and is stored on the record as the owner claim, so validate_token surfaces it for per-request attenuation. A None/empty owner is a ValueError raised before any write. |
revoke(user_id) |
Deletes the identity record + reverse lookup; False if the user is unknown. |
update_description(user_id, description) |
Rewrites the record's description; False if the user is unknown. A present record carrying no owner claim is refused loudly. |
list_identities() |
SCANs ac:key:* and returns every stored (user_id, description); an enumerated record carrying no owner claim is an invariant breach and is refused loudly. |
healthcheck() |
Probes the provider's OWN Redis storage; raises loudly if the record store is unreachable or broken. |
Requirements
Requires Python 3.13+ and any plain Redis — no modules required. The identity
records are plain Redis hashes, so redis, valkey, or any module-less
redis-server works. An unreachable or broken store is caught loudly by
healthcheck() at startup rather than failing per-request.
Install
Requires Python 3.13+. Install from PyPI into the environment that runs the server:
uv add tai42-identity-redis
Or from source — clone this repo and add it as an editable dependency; the
tai42-* dependencies resolve in-tree from the workspace.
git clone https://github.com/tai42ai/tai42 # next to your app checkout
cd /path/to/your/app
uv add --editable ../tai42/plugins/identity-redis
Development
uv venv --python 3.13
uv pip install --no-sources --editable ".[dev]"
uv run --no-sync ruff check .
uv run --no-sync ruff format --check .
uv run --no-sync pyright
uv run --no-sync pytest --cov --cov-report=term-missing
License
Apache-2.0. See LICENSE and NOTICE.
1 maintainer
Metadata
1 maintainer
Release files for tai42-identity-redis 4.3.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| tai42_identity_redis-4.3.0.tar.gz | 17.4 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| tai42_identity_redis-4.3.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 33.6 kB
Release files / tai42_identity_redis-4.3.0.tar.gz
| Download URL | tai42_identity_redis-4.3.0.tar.gz |
|---|---|
| Size | 17.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
9bf93e7f3b10ddbc50ec09ae91999e68c5a22ed9fb1cdc1cbcf0b556725f00a0
|
|
BLAKE2b-256 checksum How to use checksums |
456a4cb256fa2a1a7fe432942f2deecd246d182bc603ad4df300ae1114246827
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / tai42_identity_redis-4.3.0-py3-none-any.whl
| Download URL | tai42_identity_redis-4.3.0-py3-none-any.whl |
|---|---|
| Size | 16.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
62fc318836302fb57d4398a7644301cea3b4be2a0be6e8fc471e99edfe98e38c
|
|
BLAKE2b-256 checksum How to use checksums |
38f3b4e572f72fa3ed1a2c76d424677c8d3a08804397bdc356380a746a0866f0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Security for tai42-identity-redis 4.3.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
