Skip to content

Accounts and OAuth

octomate.config.auth

Local account credentials and token lifetimes.

AuthConfig pydantic-model

Bases: BaseModel

Deployment-owned credentials and token settings.

Config:

  • hide_input_in_errors: True

Fields:

Source code in octomate/config/auth.py 
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
class AuthConfig(BaseModel):
    """Deployment-owned credentials and token settings."""

    model_config = ConfigDict(hide_input_in_errors=True)

    invitation_lifetime: timedelta = Field(
        default=timedelta(days=7),
        gt=timedelta(0),
        description="Lifetime of an anonymous, single-use registration invitation.",
    )

    access_token_salt: SecretStr = Field(
        min_length=16, description="Secret appended before hashing access tokens."
    )
    access_token_lifetime: timedelta = Field(
        default=timedelta(minutes=15),
        gt=timedelta(0),
        description="Lifetime of an issued access token.",
    )

    refresh_token_salt: SecretStr = Field(
        min_length=16, description="Secret appended before hashing refresh tokens."
    )
    session_lifetime: timedelta = Field(
        default=timedelta(days=15),
        gt=timedelta(0),
        description="Absolute session lifetime; refresh does not extend it.",
    )
    cookie_secure: bool = Field(
        default=True, description="Require HTTPS for browser session cookies."
    )

    api_key_prefix: str = Field(
        default="omk_", description="Prefix prepended to newly issued API keys."
    )
    api_key_salt: SecretStr = Field(
        min_length=16, description="Secret appended before hashing personal API keys."
    )
    runtime_api_key_lifetime: timedelta = Field(
        default=timedelta(days=1),
        gt=timedelta(0),
        description="Maximum lifetime of a driven runtime's temporary MCP API key.",
    )

model_config class-attribute instance-attribute 

model_config = ConfigDict(hide_input_in_errors=True)

invitation_lifetime pydantic-field 

invitation_lifetime: timedelta = timedelta(days=7)

Lifetime of an anonymous, single-use registration invitation.

access_token_salt pydantic-field 

access_token_salt: SecretStr

Secret appended before hashing access tokens.

access_token_lifetime pydantic-field 

access_token_lifetime: timedelta = timedelta(minutes=15)

Lifetime of an issued access token.

refresh_token_salt pydantic-field 

refresh_token_salt: SecretStr

Secret appended before hashing refresh tokens.

session_lifetime pydantic-field 

session_lifetime: timedelta = timedelta(days=15)

Absolute session lifetime; refresh does not extend it.

cookie_secure pydantic-field 

cookie_secure: bool = True

Require HTTPS for browser session cookies.

api_key_prefix pydantic-field 

api_key_prefix: str = 'omk_'

Prefix prepended to newly issued API keys.

api_key_salt pydantic-field 

api_key_salt: SecretStr

Secret appended before hashing personal API keys.

runtime_api_key_lifetime pydantic-field 

runtime_api_key_lifetime: timedelta = timedelta(days=1)

Maximum lifetime of a driven runtime's temporary MCP API key.

octomate.config.oauth

OAuth authorization lifetimes, the browser-reachable callback origin, and the key that encrypts tokens at rest.

OAuthConfig pydantic-model

Bases: BaseModel

OAuth authorization lifetimes, callback origin and encryption key.

Config:

  • extra: ignore

Fields:

Validators:

Source code in octomate/config/oauth.py 
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
class OAuthConfig(BaseModel):
    """OAuth authorization lifetimes, callback origin and encryption key."""

    model_config = ConfigDict(extra="ignore")
    authorization_lifetime: timedelta = Field(
        default=timedelta(minutes=10),
        gt=timedelta(0),
        description=(
            "Lifetime of browser OAuth authorizations and channel profile-linking URLs; "
            "provider-issued device codes keep the provider's expiry."
        ),
    )
    token_refresh_leeway: timedelta = Field(
        default=timedelta(minutes=5),
        ge=timedelta(0),
        description="Refresh OAuth tokens this long before their expiry; numeric values are seconds.",
    )
    callback_base_uri: AnyHttpUrl | None = Field(
        default=None,
        description="Browser-reachable Octomate origin for MCP authorization callbacks and profile-linking URLs.",
    )
    client_metadata_url: HttpsUrl | None = Field(
        default=None,
        description="Optional hosted OAuth client metadata document; use dynamic registration when absent or unsupported.",
    )

    encryption_key: SecretStr | None = Field(
        default=None,
        description=(
            "URL-safe base64 encoding of the 32-byte AES key used to encrypt OAuth "
            "operation secrets and user tokens at rest."
        ),
    )

    @field_validator("callback_base_uri")
    @classmethod
    def callback_origin(cls, value: AnyHttpUrl | None) -> AnyHttpUrl | None:
        if value is not None and (
            value.path not in (None, "", "/")
            or value.username
            or value.password
            or value.query
            or value.fragment
        ):
            raise ValueError(
                "Authorization links require an HTTP origin without credentials, path, query, or fragment"
            )
        return value

    @field_validator("client_metadata_url")
    @classmethod
    def metadata_document(cls, value: HttpsUrl | None) -> HttpsUrl | None:
        if value is not None and (
            value.path in (None, "", "/")
            or value.username
            or value.password
            or value.query
            or value.fragment
        ):
            raise ValueError(
                "OAuth client metadata requires an HTTPS document URL without credentials, query, or fragment"
            )
        return value

model_config class-attribute instance-attribute 

model_config = ConfigDict(extra='ignore')

authorization_lifetime pydantic-field 

authorization_lifetime: timedelta = timedelta(minutes=10)

Lifetime of browser OAuth authorizations and channel profile-linking URLs; provider-issued device codes keep the provider's expiry.

token_refresh_leeway pydantic-field 

token_refresh_leeway: timedelta = timedelta(minutes=5)

Refresh OAuth tokens this long before their expiry; numeric values are seconds.

callback_base_uri pydantic-field 

callback_base_uri: AnyHttpUrl | None = None

Browser-reachable Octomate origin for MCP authorization callbacks and profile-linking URLs.

client_metadata_url pydantic-field 

client_metadata_url: HttpsUrl | None = None

Optional hosted OAuth client metadata document; use dynamic registration when absent or unsupported.

encryption_key pydantic-field 

encryption_key: SecretStr | None = None

URL-safe base64 encoding of the 32-byte AES key used to encrypt OAuth operation secrets and user tokens at rest.

callback_origin pydantic-validator 

callback_origin(
    value: AnyHttpUrl | None,
) -> AnyHttpUrl | None
Source code in octomate/config/oauth.py 
54
55
56
57
58
59
60
61
62
63
64
65
66
67
@field_validator("callback_base_uri")
@classmethod
def callback_origin(cls, value: AnyHttpUrl | None) -> AnyHttpUrl | None:
    if value is not None and (
        value.path not in (None, "", "/")
        or value.username
        or value.password
        or value.query
        or value.fragment
    ):
        raise ValueError(
            "Authorization links require an HTTP origin without credentials, path, query, or fragment"
        )
    return value

metadata_document pydantic-validator 

metadata_document(
    value: HttpsUrl | None,
) -> HttpsUrl | None
Source code in octomate/config/oauth.py 
69
70
71
72
73
74
75
76
77
78
79
80
81
82
@field_validator("client_metadata_url")
@classmethod
def metadata_document(cls, value: HttpsUrl | None) -> HttpsUrl | None:
    if value is not None and (
        value.path in (None, "", "/")
        or value.username
        or value.password
        or value.query
        or value.fragment
    ):
        raise ValueError(
            "OAuth client metadata requires an HTTPS document URL without credentials, query, or fragment"
        )
    return value