Skip to main content

Autonomous Workloads

Configure Workload Identity Using a SDK​

Learn how to configure workload identity using a SDK.

Step 1: Install AuthSec SDK​

pip install authsec-sdk

Get a Bearer token for a protected MCP server​

The most common workload need: exchange the pod's JWT-SVID for a scoped AuthSec access token — no stored credentials, automatic renewal:

from authsec_sdk import SpiffeWorkloadIdentity, SpiffeConfig

spiffe = SpiffeWorkloadIdentity(SpiffeConfig(
    mcp_server_url="https://your-mcp.example.com/mcp",
    client_id="YOUR_WORKLOAD_CLIENT_ID",       # from the Kubernetes-workload wizard
    spiffe_id="spiffe://your-domain/your-workload",
    scopes=["myapp:read"],
    # agent_socket_path="/run/spire/sockets/agent.sock",
))

async with spiffe:
    token = await spiffe.access_for()   # cached until near expiry
    # → Authorization: Bearer {token} on MCP requests

Dashboard setup (trust-domain registration + workload wizard): M2M auth — Method C (Kubernetes / SPIFFE).

X.509 SVIDs for mTLS​

For mutual TLS between your own services (no OAuth involved), use QuickStartSVID:

from authsec_sdk.spiffe import QuickStartSVID

svid = await QuickStartSVID.initialize(
    socket_path="/run/spire/sockets/agent.sock")
print(svid.spiffe_id)

ssl_ctx = svid.create_ssl_context_for_server()   # or ..._for_client()
note

Older examples on this page used the legacy decorator API (mcp_tool, protected_by_AuthSec, run_mcp_server_with_oauth). Those functions now live in authsec_sdk._legacy; to protect an MCP server, use mount_mcp instead.

Install and configure the SPIRE Agent​

SPIRE agent deployment (Kubernetes / Docker / VM), Helm values, verification, and troubleshooting are documented once, in the SPIRE integration section: