[DELA-208] Adding delegated token authentication in python client #2860

juskeeratanand · 2025-09-25T15:05:21Z

This PR implements the work done here to add the ability to authenticate against AWS in the python client.

This is done by the client using AWS credentials to sign a request to GetCallerIdentity and then sending that signed proof to Datadog for validation. Read more about this process here. In this PR, we add the proof generation to the datadog client and add the ability to pass that token on subsequent requests.

urnfdog

WIP, just a couple comments.

urnfdog · 2025-10-01T20:10:37Z

.generator/src/generator/templates/api_client.j2

+        :param headers: Header parameters dict to be updated.
+        :raises: ApiValueError if delegated token authentication fails
+        """
+        from datetime import datetime


Thought: Is this necessary, or can it be rolled up into a more global import?

urnfdog · 2025-10-01T20:28:28Z

src/datadog_api_client/aws.py

+
+        :return: User agent string
+        """
+        import platform


Thought: Do we need this import at the function level?

skarimo · 2025-10-15T12:52:24Z

src/datadog_api_client/api_client.py

+        # Check if we have cached credentials
+        if not hasattr(self.configuration, "_delegated_token_credentials"):
+            self.configuration._delegated_token_credentials = None


Suggested change

# Check if we have cached credentials

if not hasattr(self.configuration, "_delegated_token_credentials"):

self.configuration._delegated_token_credentials = None

Looks like this variable is already initialized as None.

skarimo · 2025-10-15T12:57:37Z

src/datadog_api_client/configuration.py

+        # Delegated token configuration
+        self.delegated_token_config = None
+
        # Load default values from environment


Looks like constructors are missing in the config for fields such as delegated_auth_provider and delegated_auth_org_uuid

skarimo · 2025-10-15T12:58:33Z

src/datadog_api_client/api_client.py

+            config = DelegatedTokenConfig(
+                org_uuid=self.configuration.delegated_auth_org_uuid,
+                provider="aws",  # This could be made configurable
+                provider_auth=self.configuration.delegated_auth_provider,
+            )


I am not sure how often the token refreshes but we should move this up to class initialization as it seems to be a static config for the most part.

skarimo · 2025-10-15T13:04:16Z

src/datadog_api_client/delegated_auth.py

+    url = get_delegated_token_url(config)
+
+    # Create REST client
+    rest_client = rest.RESTClientObject(config)


Can we pass the rest client initialized in the api_client? If not we should initialize this once and store it for future use

urnfdog

I'm assuming that signing mechanisms (especially HMAC) are all taken directly from AWS specs

urnfdog · 2025-10-24T17:50:50Z

.generator/src/generator/templates/delegated_auth.j2

+    """
+    try:
+        token_response = json.loads(response_data)
+    except json.JSONDecodeError as e:


💭 Do we need to catch other kinds of errors here, and is there a reason we handle JSONDecodeError specifically?

this catches when the json parsing fails which would be the most expected error, and any other errors would be caught by the outer block

src/datadog_api_client/api_client.py

urnfdog · 2025-10-24T18:03:18Z

src/datadog_api_client/delegated_auth.py

+    """
+    try:
+        token_response = json.loads(response_data)
+    except json.JSONDecodeError as e:


Similar question around if we need to handle other types of errors

urnfdog · 2025-10-24T18:05:13Z

tests/aws_test.py

+            "AWS_ACCESS_KEY_ID": "AKIAIOSFODNN7EXAMPLE",
+            "AWS_SECRET_ACCESS_KEY": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+            "AWS_SESSION_TOKEN": "test-session-token",


Note: These are the example access key values from AWS docs, including GetAccessKeyInfo

Co-authored-by: Kevin L <96131879+urnfdog@users.noreply.github.com>

juskeeratanand · 2025-11-03T15:39:30Z

/merge

dd-devflow-routing-codex · 2025-11-03T15:39:35Z

View all feedbacks in Devflow UI.

2025-11-03 15:39:34 UTC ℹ️ Start processing command /merge

2025-11-03 15:39:42 UTC ℹ️ MergeQueue: waiting for PR to be ready

This pull request is not mergeable according to GitHub. Common reasons include pending required checks, missing approvals, or merge conflicts — but it could also be blocked by other repository rules or settings.
It will be added to the queue as soon as checks pass and/or get approvals.
Note: if you pushed new commits since the last approval, you may need additional approval.
You can remove it from the waiting list with /remove command.

2025-11-03 16:20:54 UTC ⚠️ MergeQueue: This merge request was unqueued

juskeerat.anand@datadoghq.com unqueued this merge request

juskeeratanand · 2025-11-03T16:20:46Z

/remove

dd-devflow-routing-codex · 2025-11-03T16:20:48Z

View all feedbacks in Devflow UI.

2025-11-03 16:20:48 UTC ℹ️ Start processing command /remove

2025-11-03 16:20:51 UTC ℹ️ Devflow: /remove

juskeeratanand · 2025-11-03T16:21:10Z

/merge

juskeeratanand · 2025-11-03T16:22:58Z

/remove

dd-devflow-routing-codex · 2025-11-03T16:23:00Z

View all feedbacks in Devflow UI.

2025-11-03 16:23:00 UTC ℹ️ Start processing command /remove

2025-11-03 16:23:03 UTC ℹ️ Devflow: /remove

juskeeratanand · 2025-11-03T16:26:16Z

/merge

dd-devflow-routing-codex · 2025-11-03T16:26:21Z

View all feedbacks in Devflow UI.

2025-11-03 16:26:20 UTC ℹ️ Start processing command /merge

2025-11-03 16:26:28 UTC ℹ️ MergeQueue: waiting for PR to be ready

This pull request is not mergeable according to GitHub. Common reasons include pending required checks, missing approvals, or merge conflicts — but it could also be blocked by other repository rules or settings.
It will be added to the queue as soon as checks pass and/or get approvals.
Note: if you pushed new commits since the last approval, you may need additional approval.
You can remove it from the waiting list with /remove command.

2025-11-03 16:31:31 UTC ℹ️ MergeQueue: This merge request was already merged

This pull request was merged directly.

) * changed template files + generate * rename file * rename files to match go client * fix aws tests * fix conftest * Restore docs/datadog_api_client.rst file * regen * print header * fix headers * fix config propogation * feedback updates * rest changes * gen * update * del * fix tests * static config * update config * updates tests * update imports * config * Update src/datadog_api_client/api_client.py Co-authored-by: Kevin L <96131879+urnfdog@users.noreply.github.com> * Update src/datadog_api_client/api_client.py Co-authored-by: Kevin L <96131879+urnfdog@users.noreply.github.com> * pre-commit fixes --------- Co-authored-by: Kevin L <96131879+urnfdog@users.noreply.github.com> Co-authored-by: ci.datadog-api-spec <packages@datadoghq.com> cb28bb6

changed template files + generate

f249e41

juskeeratanand changed the title ~~changed template files + generate~~ [DELA-208] Adding delegated token authentication in python client Sep 25, 2025

juskeeratanand added 6 commits September 26, 2025 15:04

rename file

119ff63

rename files to match go client

73832a6

fix aws tests

dab1f44

fix conftest

a5ac295

Restore docs/datadog_api_client.rst file

f0e6197

regen

eaa857f

juskeeratanand requested a review from wynbennett September 29, 2025 17:25

juskeeratanand added 2 commits September 29, 2025 14:54

print header

848f934

fix headers

19bef19

juskeeratanand marked this pull request as ready for review September 29, 2025 20:27

juskeeratanand requested review from a team as code owners September 29, 2025 20:27

juskeeratanand added the changelog/Added label Sep 29, 2025

juskeeratanand requested a review from a team September 29, 2025 20:47

juskeeratanand marked this pull request as draft September 30, 2025 17:33

fix config propogation

6d3ae95

juskeeratanand marked this pull request as ready for review September 30, 2025 18:28

urnfdog reviewed Oct 1, 2025

View reviewed changes

wynbennett approved these changes Oct 8, 2025

View reviewed changes

skarimo reviewed Oct 15, 2025

View reviewed changes

juskeeratanand force-pushed the DELA-208 branch from 570de71 to 6d3ae95 Compare October 21, 2025 20:38

juskeeratanand added 2 commits October 21, 2025 16:48

feedback updates

ae4e865

rest changes

96ee4c4

github-actions bot added the documentation Improvements or additions to documentation label Oct 22, 2025

juskeeratanand added 4 commits October 22, 2025 10:19

gen

5d3d743

update

dc003ce

del

d5e6dbd

fix tests

b790241

juskeeratanand requested a review from skarimo October 23, 2025 15:37

urnfdog reviewed Oct 24, 2025

View reviewed changes

juskeeratanand and others added 3 commits October 27, 2025 15:28

Update src/datadog_api_client/api_client.py

023e4d5

Co-authored-by: Kevin L <96131879+urnfdog@users.noreply.github.com>

Update src/datadog_api_client/api_client.py

dd0f9fc

Co-authored-by: Kevin L <96131879+urnfdog@users.noreply.github.com>

pre-commit fixes

19b8089

skarimo approved these changes Nov 3, 2025

View reviewed changes

dd-devflow bot added the mergequeue-status: waiting label Nov 3, 2025

dd-devflow bot added mergequeue-status: removed and removed mergequeue-status: waiting labels Nov 3, 2025

This comment was marked as outdated.

Sign in to view

dd-devflow bot added mergequeue-status: waiting and removed mergequeue-status: removed labels Nov 3, 2025

dd-devflow bot added mergequeue-status: removed and removed mergequeue-status: waiting labels Nov 3, 2025

dd-devflow bot added mergequeue-status: waiting and removed mergequeue-status: removed labels Nov 3, 2025

skarimo merged commit cb28bb6 into master Nov 3, 2025
35 checks passed

skarimo deleted the DELA-208 branch November 3, 2025 16:31

dd-devflow bot added mergequeue-status: done and removed mergequeue-status: waiting labels Nov 3, 2025

	# Check if we have cached credentials
	if not hasattr(self.configuration, "_delegated_token_credentials"):
	self.configuration._delegated_token_credentials = None

[DELA-208] Adding delegated token authentication in python client #2860

[DELA-208] Adding delegated token authentication in python client #2860

Conversation

juskeeratanand commented Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

urnfdog left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

urnfdog left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

juskeeratanand commented Nov 3, 2025

Uh oh!

dd-devflow-routing-codex bot commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

juskeeratanand commented Nov 3, 2025

Uh oh!

dd-devflow-routing-codex bot commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

juskeeratanand commented Nov 3, 2025

Uh oh!

This comment was marked as outdated.

juskeeratanand commented Nov 3, 2025

Uh oh!

dd-devflow-routing-codex bot commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

juskeeratanand commented Nov 3, 2025

Uh oh!

dd-devflow-routing-codex bot commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

juskeeratanand commented Sep 25, 2025 •

edited

Loading

dd-devflow-routing-codex bot commented Nov 3, 2025 •

edited

Loading

dd-devflow-routing-codex bot commented Nov 3, 2025 •

edited

Loading

dd-devflow-routing-codex bot commented Nov 3, 2025 •

edited

Loading

dd-devflow-routing-codex bot commented Nov 3, 2025 •

edited

Loading