HTTP workers authenticate requests via a pluggable callback that populates CallContext.auth with
an AuthContext. Bearer-token and JWT/JWKS authenticators ship in vgi.auth. Secrets (credentials)
flow through the secret protocol so workers never see raw values unless explicitly resolved. See the
Authentication guide.
AuthContext and CallContext are re-exported from vgi-rpc. The bearer/chain authenticators
require pip install vgi-python[http]; JWT authentication additionally requires [oauth].
::: vgi.auth
TokenIdentity is what [Worker.resolve_token][vgi.worker.Worker.resolve_token] returns: a
principal plus an optional token_name. It lives in a private vgi-rpc module, so vgi.auth
re-exports it — a worker that implements resolve_token never has to name a private import path.
As of vgi-rpc 0.46.0 introspection is the vgi_rpc.Identity.v1 protocol hosted on the RPC server,
not an HTTP JSON route, so clients discover it through reflection. VGI hosts it on HTTP only, the
transport that authenticates callers: its allowlist names principals, which stdin/stdout, AF_UNIX
and TCP do not have. TokenIdentity and TokenResolver are no longer gated on the [http] extra.
::: vgi.secret_protocol
::: vgi.secret_service