You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/langsmith/auth.mdx
+28-28Lines changed: 28 additions & 28 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@ While often used interchangeably, these terms represent distinct security concep
14
14
*[**Authentication**](#authentication) ("AuthN") verifies _who_ you are. This runs as middleware for every request.
15
15
*[**Authorization**](#authorization) ("AuthZ") determines _what you can do_. This validates the user's privileges and roles on a per-resource basis.
16
16
17
-
In LangSmith, authentication is handled by your [`@auth.authenticate`](/langsmith/smith-python-sdk#langgraph_sdk.auth.Auth.authenticate) handler, and authorization is handled by your [`@auth.on`](/langsmith/langgraph-python-sdk#langgraph_sdk.auth.Auth.on) handlers.
17
+
In LangSmith, authentication is handled by your @[`@auth.authenticate`][Auth.authenticate] handler, and authorization is handled by your @[`@auth.on`][Auth.on] handlers.
18
18
19
19
## Default security models
20
20
@@ -76,15 +76,15 @@ sequenceDiagram
76
76
LG-->>Client: 8. Return resources
77
77
```
78
78
79
-
Your [`@auth.authenticate`](/langsmith/langgraph-python-sdk#langgraph_sdk.auth.Auth.authenticate) handler in LangGraph handles steps 4-6, while your [`@auth.on`](/langsmith/langgraph-python-sdk#langgraph_sdk.auth.Auth.on) handlers implement step 7.
79
+
Your @[`@auth.authenticate`][Auth.authenticate] handler in LangGraph handles steps 4-6, while your @[`@auth.on`][Auth.on] handlers implement step 7.
80
80
81
81
## Authentication
82
82
83
-
Authentication in LangGraph runs as middleware on every request. Your [`@auth.authenticate`](/langsmith/langgraph-python-sdk#langgraph_sdk.auth.Auth.authenticate) handler receives request information and should:
83
+
Authentication in LangGraph runs as middleware on every request. Your @[`@auth.authenticate`][Auth.authenticate] handler receives request information and should:
84
84
85
85
1. Validate the credentials
86
-
2. Return [user info](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.MinimalUserDict) containing the user's identity and user information if valid
87
-
3. Raise an [HTTP exception](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.exceptions.HTTPException) or AssertionError if invalid
86
+
2. Return @[user info][MinimalUserDict] containing the user's identity and user information if valid
87
+
3. Raise an @[HTTP exception][HTTPException] or AssertionError if invalid
* To your authorization handlers via [`ctx.user`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.AuthContext)
119
+
* To your authorization handlers via @[`ctx.user`][AuthContext]
120
120
* In your application via `config["configuration"]["langgraph_auth_user"]`
121
121
122
122
<Accordiontitle="Supported Parameters">
123
-
The [`@auth.authenticate`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.Auth.authenticate) handler can accept any of the following parameters by name:
123
+
The @[`@auth.authenticate`][Auth.authenticate] handler can accept any of the following parameters by name:
124
124
125
125
* request (Request): The raw ASGI request object
126
126
* path (str): The request path, e.g., `"/threads/abcd-1234-abcd-1234/runs/abcd-1234-abcd-1234/stream"`
@@ -172,7 +172,7 @@ sequenceDiagram
172
172
```
173
173
174
174
After authentication, the platform creates a special configuration object that is passed to your graph and all nodes via the configurable context.
175
-
This object contains information about the current user, including any custom fields you return from your [`@auth.authenticate`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.Auth.authenticate) handler.
175
+
This object contains information about the current user, including any custom fields you return from your @[`@auth.authenticate`][Auth.authenticate] handler.
176
176
177
177
To enable an agent to act on behalf of the user, use [custom authentication middleware](/langsmith/custom-auth). This will allow the agent to interact with external systems like MCP servers, external databases, and even other agents on behalf of the user.
178
178
@@ -184,13 +184,13 @@ For information on how to authenticate an agent to an MCP server, see the [MCP c
184
184
185
185
## Authorization
186
186
187
-
After authentication, LangGraph calls your [`@auth.on`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.Auth.on) handlers to control access to specific resources (e.g., threads, assistants, crons). These handlers can:
187
+
After authentication, LangGraph calls your @[`@auth.on`][Auth] handlers to control access to specific resources (e.g., threads, assistants, crons). These handlers can:
188
188
189
189
1. Add metadata to be saved during resource creation by mutating the `value["metadata"]` dictionary directly. See the [supported actions table](#supported-actions) for the list of types the value can take for each action.
190
190
2. Filter resources by metadata during search/list or read operations by returning a [filter dictionary](#filter-operations).
191
191
3. Raise an HTTP exception if access is denied.
192
192
193
-
If you want to just implement simple user-scoped access control, you can use a single [`@auth.on`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.Auth.on) handler for all resources and actions. If you want to have different control depending on the resource and action, you can use [resource-specific handlers](#resource-specific-handlers). See the [Supported Resources](#supported-resources) section for a full list of the resources that support access control.
193
+
If you want to just implement simple user-scoped access control, you can use a single @[`@auth.on`][Auth] handler for all resources and actions. If you want to have different control depending on the resource and action, you can use [resource-specific handlers](#resource-specific-handlers). See the [Supported Resources](#supported-resources) section for a full list of the resources that support access control.
194
194
195
195
```python
196
196
@auth.on
@@ -235,7 +235,7 @@ async def add_owner(
235
235
<aid="resource-specific-handlers"></a>
236
236
### Resource-specific handlers
237
237
238
-
You can register handlers for specific resources and actions by chaining the resource and action names together with the [`@auth.on`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.Auth.on) decorator.
238
+
You can register handlers for specific resources and actions by chaining the resource and action names together with the @[`@auth.on`][Auth] decorator.
239
239
When a request is made, the most specific handler that matches that resource and action is called. Below is an example of how to register handlers for specific resources and actions. For the following setup:
240
240
241
241
1. Authenticated users are able to create threads, read threads, and create runs on threads
@@ -351,7 +351,7 @@ A filter dictionary is a dictionary with keys that match the resource metadata.
351
351
*`$contains`: List membership (e.g., `{"allowed_users": {"$contains": user_id}}`) or list containment (e.g., `{"allowed_users": {"$contains": [user_id_1, user_id_2]}}`). The value here must be an element of the list or a subset of the elements of the list, respectively. The metadata in the stored resource must be a list/container type.
352
352
353
353
A dictionary with multiple keys is treated using a logical `AND` filter. For example, `{"owner": org_id, "allowed_users": {"$contains": user_id}}` will only match resources with metadata whose "owner" is `org_id` and whose "allowed_users" list contains `user_id`.
354
-
See the reference [here](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.FilterType) for more information.
354
+
See the reference @[`Auth`](Auth) for more information.
355
355
356
356
## Common access patterns
357
357
@@ -457,22 +457,22 @@ Here are all the supported action handlers:
||`@auth.on.threads.create_run`| Creating or updating a run |[`RunsCreate`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.RunsCreate)|
||`@auth.on.crons.search`| Listing cron jobs |[`CronsSearch`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.CronsSearch)|
0 commit comments