ya-oauth-provider
Pydantic AI model/provider helpers that consume OAuth token sources from ya-oauth.
Codex model string
YA Agent SDK loads this package for model strings such as:
oauth@codex:gpt-5.5
The provider owns Codex request authentication and header alignment. It attaches the
bearer token, ChatGPT account ID, optional FedRAMP marker, originator, underscore and
hyphen variants of session/thread headers, SDK-provided x-session-id, and
x-client-request-id. It omits the Codex
version header by default to avoid coupling YA package versions to Codex CLI release
gates.
Generic OpenAI Responses WebSocket transport remains in ya-agent-sdk as
WebsocketResponsesModel. This package adds only Codex-specific authentication,
headers, token refresh, and payload normalization, and refreshes once on HTTP 401
through the configured token source before retrying. Its OpenAI client, OAuth auth
flow, and retry transport all use HTTPX2; callers must not inject a legacy
httpx.AsyncClient. The SDK-created client closes with the model context and is
recreated on re-entry. OAuth authentication buffers the request body once so Codex
payload normalization and a possible 401 replay operate on identical bytes.
The OAuth Codex models also follow Codex's backend-routing contracts. Every request
sets x-codex-routing-hint to model=<model> and appends ;tier=<service-tier> when
a service tier is selected. The first x-codex-turn-state returned during a Pydantic
AI run is retained without replacement and replayed only within that run. HTTP sends
it as a request header; WebSocket sends it in
client_metadata["x-codex-turn-state"], matching the Codex WebSocket protocol. A
new Pydantic AI run starts with no turn state. These behaviors are deliberately
limited to oauth@codex:*; ordinary openai-responses:* and
openai-responses-ws:* models remain generic.
Proactive refresh
ya_oauth_provider.OAuthRefreshSupervisor refreshes configured OAuth token sources on startup and on a background interval. Runtime packages can use create_oauth_refresh_supervisor_for_models(...) to detect oauth@provider:model strings and maintain logged-in providers before the first model request needs a token refresh.
1 maintainer
Metadata
1 maintainer
Release files for ya-oauth-provider 2.12.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| ya_oauth_provider-2.12.0.tar.gz | 15.3 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| ya_oauth_provider-2.12.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 26.5 kB
Release files / ya_oauth_provider-2.12.0.tar.gz
| Download URL | ya_oauth_provider-2.12.0.tar.gz |
|---|---|
| Size | 15.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
cd3004a3ed15d46ac8387a1bedf8d41e75dc50871d06f0b3c440aba982062116
|
|
BLAKE2b-256 checksum How to use checksums |
cb2f2476dfaf6a2785aaf78ea1fa2de403aeca01aaea15f07d658a5feda751e0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.11.14 {"installer":{"name":"uv","version":"0.11.14","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"26.04","id":"resolute","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / ya_oauth_provider-2.12.0-py3-none-any.whl
| Download URL | ya_oauth_provider-2.12.0-py3-none-any.whl |
|---|---|
| Size | 11.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
70d01c2c2e5218b390d04873b81dd24ac75881ac9f5aa9f2567798828b59c5eb
|
|
BLAKE2b-256 checksum How to use checksums |
01c3e94873639fb1d30890445b4c55639ad0722ab4454768856b19572fe812a3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.11.14 {"installer":{"name":"uv","version":"0.11.14","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"26.04","id":"resolute","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Security for ya-oauth-provider 2.12.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
