You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: packages/toolbox-langchain/README.md
+25-9Lines changed: 25 additions & 9 deletions
Original file line number
Diff line number
Diff line change
@@ -197,24 +197,34 @@ execution outside of an agent framework.
197
197
This section describes how to authenticate the ToolboxClient itself when
198
198
connecting to a Toolbox server instance that requires authentication. This is
199
199
crucial for securing your Toolbox server endpoint, especially when deployed on
200
-
platforms like Cloud Run, GKE, or any environment where unauthenticated access is restricted.
200
+
platforms like Cloud Run, GKE, or any environment where unauthenticated access
201
+
is restricted.
201
202
202
-
This client-to-server authentication ensures that the Toolbox server can verify the identity of the client making the request before any tool is loaded or called. It is different from [Authenticating Tools](#authenticating-tools), which deals with providing credentials for specific tools within an already connected Toolbox session.
203
+
This client-to-server authentication ensures that the Toolbox server can verify
204
+
the identity of the client making the request before any tool is loaded or
205
+
called. It is different from [Authenticating Tools](#authenticating-tools),
206
+
which deals with providing credentials for specific tools within an already
207
+
connected Toolbox session.
203
208
204
209
### When is Client-to-Server Authentication Needed?
205
210
206
-
You'll need this type of authentication if your Toolbox server is configured to deny unauthenticated requests. For example:
211
+
You'll need this type of authentication if your Toolbox server is configured to
212
+
deny unauthenticated requests. For example:
207
213
208
214
- Your Toolbox server is deployed on Cloud Run and configured to "Require authentication."
209
-
- Your server is behind an Identity-Aware Proxy (IAP) or a similar authentication layer.
215
+
- Your server is behind an Identity-Aware Proxy (IAP) or a similar
216
+
authentication layer.
210
217
- You have custom authentication middleware on your self-hosted Toolbox server.
211
218
212
219
Without proper client authentication in these scenarios, attempts to connect or
213
220
make calls (like `load_tool`) will likely fail with `Unauthorized` errors.
214
221
215
222
### How it works
216
223
217
-
The `ToolboxClient` (and `ToolboxSyncClient`) allows you to specify functions (or coroutines for the async client) that dynamically generate HTTP headers for every request sent to the Toolbox server. The most common use case is to add an Authorization header with a bearer token (e.g., a Google ID token).
224
+
The `ToolboxClient` allows you to specify functions (or coroutines for the async
225
+
client) that dynamically generate HTTP headers for every request sent to the
226
+
Toolbox server. The most common use case is to add an Authorization header with
227
+
a bearer token (e.g., a Google ID token).
218
228
219
229
These header-generating functions are called just before each request, ensuring
220
230
that fresh credentials or header values can be used.
@@ -228,7 +238,10 @@ You can configure these dynamic headers in two ways:
@@ -248,7 +261,9 @@ For Toolbox servers hosted on Google Cloud (e.g., Cloud Run) and requiring
248
261
249
262
### Step by Step Guide for Cloud Run
250
263
251
-
1. **Configure Permissions**: [Grant](https://cloud.google.com/run/docs/securing/managing-access#service-add-principals) the `roles/run.invoker` IAM role on the Cloud
0 commit comments