feat(mux): mint agent gateway tokens for running devboxes (#10872)

Author: stainless-app[bot]

.stats.yml

@@ -1,4 +1,4 @@
-configured_endpoints: 122
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/runloop-ai/runloop-e5f0e0681128eb37d05a98356a9d0df494ac490f717abc9911ea8a637be6b8e9.yml
-openapi_spec_hash: d95f699402c754e0d1623888526062b1
-config_hash: 5cc6fa1369335945123744d5210963b1
+configured_endpoints: 123
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/runloop-ai/runloop-d93d04979b6fb3a12da8d7a30fef35d3fe51716f4e9998a7cca5b591187203fc.yml
+openapi_spec_hash: e0c6980655d2614c9951c9f231f99cbc
+config_hash: a24309fd705de8a4c9c014e8a54d6099

api.md

@@ -214,6 +214,7 @@ from runloop_api_client.types import (
     DevboxSnapshotListView,
     DevboxSnapshotView,
     DevboxView,
+    GatewayTokenView,
     McpTokenView,
     PtyTunnelView,
     TunnelView,
@@ -229,6 +230,7 @@ Methods:
 - <code title="get /v1/devboxes/{id}">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">retrieve</a>(id) -> <a href="./src/runloop_api_client/types/devbox_view.py">DevboxView</a></code>
 - <code title="post /v1/devboxes/{id}">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">update</a>(id, \*\*<a href="src/runloop_api_client/types/devbox_update_params.py">params</a>) -> <a href="./src/runloop_api_client/types/devbox_view.py">DevboxView</a></code>
 - <code title="get /v1/devboxes">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">list</a>(\*\*<a href="src/runloop_api_client/types/devbox_list_params.py">params</a>) -> <a href="./src/runloop_api_client/types/devbox_view.py">SyncDevboxesCursorIDPage[DevboxView]</a></code>
+- <code title="post /v1/devboxes/{id}/create_gateway_token">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">create_gateway_token</a>(id, \*\*<a href="src/runloop_api_client/types/devbox_create_gateway_token_params.py">params</a>) -> <a href="./src/runloop_api_client/types/gateway_token_view.py">GatewayTokenView</a></code>
 - <code title="post /v1/devboxes/{id}/create_mcp_token">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">create_mcp_token</a>(id, \*\*<a href="src/runloop_api_client/types/devbox_create_mcp_token_params.py">params</a>) -> <a href="./src/runloop_api_client/types/mcp_token_view.py">McpTokenView</a></code>
 - <code title="post /v1/devboxes/{id}/create_pty_tunnel">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">create_pty_tunnel</a>(id) -> <a href="./src/runloop_api_client/types/pty_tunnel_view.py">PtyTunnelView</a></code>
 - <code title="post /v1/devboxes/{id}/create_ssh_key">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">create_ssh_key</a>(id) -> <a href="./src/runloop_api_client/types/devbox_create_ssh_key_response.py">DevboxCreateSSHKeyResponse</a></code>

src/runloop_api_client/resources/devboxes/devboxes.py

@@ -37,6 +37,7 @@
     devbox_list_disk_snapshots_params,
     devbox_snapshot_disk_async_params,
     devbox_write_file_contents_params,
+    devbox_create_gateway_token_params,
 )
 from ..._files import deepcopy_with_paths
 from ..._types import Body, Omit, Query, Headers, NotGiven, FileTypes, omit, not_given
@@ -94,6 +95,7 @@
 from ...lib.wait_for_status import wait_for_status, async_wait_for_status
 from ...types.mcp_token_view import McpTokenView
 from ...types.pty_tunnel_view import PtyTunnelView
+from ...types.gateway_token_view import GatewayTokenView
 from ...types.shared_params.mount import Mount
 from ...types.devbox_snapshot_view import DevboxSnapshotView
 from ...types.shared.launch_parameters import LaunchParameters as SharedLaunchParameters
@@ -610,6 +612,66 @@ def list(
             model=DevboxView,
         )
 
+    def create_gateway_token(
+        self,
+        id: str,
+        *,
+        gateway: str,
+        secret: str,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+        idempotency_key: str | None = None,
+    ) -> GatewayTokenView:
+        """
+        Mint a token that lets a running Devbox call an external API through the Runloop
+        agent gateway, using the credential in the supplied secret. The gateway applies
+        the credential to proxied requests, so the real API key is never exposed to the
+        Devbox.
+
+        The token is bound to this Devbox and is only accepted for requests that
+        originate from it. Nothing is stored on the Devbox: the token is returned to the
+        caller and is not re-issued when the Devbox is resumed.
+
+        Args:
+          gateway: The gateway config to use. Can be a gateway config ID (gwc_xxx) or name.
+
+          secret: The secret containing the credential. Can be a secret ID or name.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+
+          idempotency_key: Specify a custom idempotency key for this request
+        """
+        if not id:
+            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        return self._post(
+            path_template("/v1/devboxes/{id}/create_gateway_token", id=id),
+            body=maybe_transform(
+                {
+                    "gateway": gateway,
+                    "secret": secret,
+                },
+                devbox_create_gateway_token_params.DevboxCreateGatewayTokenParams,
+            ),
+            options=make_request_options(
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                idempotency_key=idempotency_key,
+            ),
+            cast_to=GatewayTokenView,
+        )
+
     def create_mcp_token(
         self,
         id: str,
@@ -2386,6 +2448,66 @@ def list(
             model=DevboxView,
         )
 
+    async def create_gateway_token(
+        self,
+        id: str,
+        *,
+        gateway: str,
+        secret: str,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+        idempotency_key: str | None = None,
+    ) -> GatewayTokenView:
+        """
+        Mint a token that lets a running Devbox call an external API through the Runloop
+        agent gateway, using the credential in the supplied secret. The gateway applies
+        the credential to proxied requests, so the real API key is never exposed to the
+        Devbox.
+
+        The token is bound to this Devbox and is only accepted for requests that
+        originate from it. Nothing is stored on the Devbox: the token is returned to the
+        caller and is not re-issued when the Devbox is resumed.
+
+        Args:
+          gateway: The gateway config to use. Can be a gateway config ID (gwc_xxx) or name.
+
+          secret: The secret containing the credential. Can be a secret ID or name.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+
+          idempotency_key: Specify a custom idempotency key for this request
+        """
+        if not id:
+            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        return await self._post(
+            path_template("/v1/devboxes/{id}/create_gateway_token", id=id),
+            body=await async_maybe_transform(
+                {
+                    "gateway": gateway,
+                    "secret": secret,
+                },
+                devbox_create_gateway_token_params.DevboxCreateGatewayTokenParams,
+            ),
+            options=make_request_options(
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                idempotency_key=idempotency_key,
+            ),
+            cast_to=GatewayTokenView,
+        )
+
     async def create_mcp_token(
         self,
         id: str,
@@ -3700,6 +3822,9 @@ def __init__(self, devboxes: DevboxesResource) -> None:
         self.list = to_raw_response_wrapper(
             devboxes.list,
         )
+        self.create_gateway_token = to_raw_response_wrapper(
+            devboxes.create_gateway_token,
+        )
         self.create_mcp_token = to_raw_response_wrapper(
             devboxes.create_mcp_token,
         )
@@ -3802,6 +3927,9 @@ def __init__(self, devboxes: AsyncDevboxesResource) -> None:
         self.list = async_to_raw_response_wrapper(
             devboxes.list,
         )
+        self.create_gateway_token = async_to_raw_response_wrapper(
+            devboxes.create_gateway_token,
+        )
         self.create_mcp_token = async_to_raw_response_wrapper(
             devboxes.create_mcp_token,
         )
@@ -3904,6 +4032,9 @@ def __init__(self, devboxes: DevboxesResource) -> None:
         self.list = to_streamed_response_wrapper(
             devboxes.list,
         )
+        self.create_gateway_token = to_streamed_response_wrapper(
+            devboxes.create_gateway_token,
+        )
         self.create_mcp_token = to_streamed_response_wrapper(
             devboxes.create_mcp_token,
         )
@@ -4006,6 +4137,9 @@ def __init__(self, devboxes: AsyncDevboxesResource) -> None:
         self.list = async_to_streamed_response_wrapper(
             devboxes.list,
         )
+        self.create_gateway_token = async_to_streamed_response_wrapper(
+            devboxes.create_gateway_token,
+        )
         self.create_mcp_token = async_to_streamed_response_wrapper(
             devboxes.create_mcp_token,
         )

src/runloop_api_client/types/__init__.py

@@ -53,6 +53,7 @@
 from .benchmark_job_view import BenchmarkJobView as BenchmarkJobView
 from .benchmark_run_view import BenchmarkRunView as BenchmarkRunView
 from .devbox_list_params import DevboxListParams as DevboxListParams
+from .gateway_token_view import GatewayTokenView as GatewayTokenView
 from .object_list_params import ObjectListParams as ObjectListParams
 from .pty_connect_params import PtyConnectParams as PtyConnectParams
 from .pty_control_params import PtyControlParams as PtyControlParams
@@ -150,6 +151,7 @@
 from .devbox_snapshot_disk_async_params import DevboxSnapshotDiskAsyncParams as DevboxSnapshotDiskAsyncParams
 from .devbox_write_file_contents_params import DevboxWriteFileContentsParams as DevboxWriteFileContentsParams
 from .devbox_async_execution_detail_view import DevboxAsyncExecutionDetailView as DevboxAsyncExecutionDetailView
+from .devbox_create_gateway_token_params import DevboxCreateGatewayTokenParams as DevboxCreateGatewayTokenParams
 from .devbox_read_file_contents_response import DevboxReadFileContentsResponse as DevboxReadFileContentsResponse
 from .benchmark_run_list_scenario_runs_params import (
     BenchmarkRunListScenarioRunsParams as BenchmarkRunListScenarioRunsParams,

src/runloop_api_client/types/devbox_create_gateway_token_params.py

@@ -0,0 +1,15 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Required, TypedDict
+
+__all__ = ["DevboxCreateGatewayTokenParams"]
+
+
+class DevboxCreateGatewayTokenParams(TypedDict, total=False):
+    gateway: Required[str]
+    """The gateway config to use. Can be a gateway config ID (gwc_xxx) or name."""
+
+    secret: Required[str]
+    """The secret containing the credential. Can be a secret ID or name."""

src/runloop_api_client/types/gateway_token_view.py

@@ -0,0 +1,33 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from .._models import BaseModel
+from .shared.auth_mechanism import AuthMechanism
+
+__all__ = ["GatewayTokenView"]
+
+
+class GatewayTokenView(BaseModel):
+    token: str
+    """The token to send to the gateway as a Bearer token in the Authorization header.
+
+    Only accepted for requests originating from the bound Devbox.
+    """
+
+    auth_mechanism: AuthMechanism
+    """How the gateway applies the credential to proxied requests."""
+
+    devbox_id: str
+    """The Devbox the token is bound to."""
+
+    endpoint: str
+    """The target API endpoint the gateway proxies to."""
+
+    gateway_config_id: str
+    """The ID of the gateway config the token proxies through."""
+
+    url: str
+    """The gateway URL to send requests to.
+
+    Matches the value of the {prefix}\\__URL environment variable inside the
+    Devbox.
+    """

tests/api_resources/test_devboxes.py

@@ -17,6 +17,7 @@
     TunnelView,
     McpTokenView,
     PtyTunnelView,
+    GatewayTokenView,
     DevboxSnapshotView,
     DevboxResourceUsageView,
     DevboxExecutionDetailView,
@@ -275,6 +276,52 @@ def test_streaming_response_list(self, client: Runloop) -> None:
 
         assert cast(Any, response.is_closed) is True
 
+    @parametrize
+    def test_method_create_gateway_token(self, client: Runloop) -> None:
+        devbox = client.devboxes.create_gateway_token(
+            id="id",
+            gateway="gateway",
+            secret="secret",
+        )
+        assert_matches_type(GatewayTokenView, devbox, path=["response"])
+
+    @parametrize
+    def test_raw_response_create_gateway_token(self, client: Runloop) -> None:
+        response = client.devboxes.with_raw_response.create_gateway_token(
+            id="id",
+            gateway="gateway",
+            secret="secret",
+        )
+
+        assert response.is_closed is True
+        assert response.http_request.headers.get("X-Stainless-Lang") == "python"
+        devbox = response.parse()
+        assert_matches_type(GatewayTokenView, devbox, path=["response"])
+
+    @parametrize
+    def test_streaming_response_create_gateway_token(self, client: Runloop) -> None:
+        with client.devboxes.with_streaming_response.create_gateway_token(
+            id="id",
+            gateway="gateway",
+            secret="secret",
+        ) as response:
+            assert not response.is_closed
+            assert response.http_request.headers.get("X-Stainless-Lang") == "python"
+
+            devbox = response.parse()
+            assert_matches_type(GatewayTokenView, devbox, path=["response"])
+
+        assert cast(Any, response.is_closed) is True
+
+    @parametrize
+    def test_path_params_create_gateway_token(self, client: Runloop) -> None:
+        with pytest.raises(ValueError, match=r"Expected a non-empty value for `id` but received ''"):
+            client.devboxes.with_raw_response.create_gateway_token(
+                id="",
+                gateway="gateway",
+                secret="secret",
+            )
+
     @parametrize
     def test_method_create_mcp_token(self, client: Runloop) -> None:
         devbox = client.devboxes.create_mcp_token(
@@ -2084,6 +2131,52 @@ async def test_streaming_response_list(self, async_client: AsyncRunloop) -> None
 
         assert cast(Any, response.is_closed) is True
 
+    @parametrize
+    async def test_method_create_gateway_token(self, async_client: AsyncRunloop) -> None:
+        devbox = await async_client.devboxes.create_gateway_token(
+            id="id",
+            gateway="gateway",
+            secret="secret",
+        )
+        assert_matches_type(GatewayTokenView, devbox, path=["response"])
+
+    @parametrize
+    async def test_raw_response_create_gateway_token(self, async_client: AsyncRunloop) -> None:
+        response = await async_client.devboxes.with_raw_response.create_gateway_token(
+            id="id",
+            gateway="gateway",
+            secret="secret",
+        )
+
+        assert response.is_closed is True
+        assert response.http_request.headers.get("X-Stainless-Lang") == "python"
+        devbox = await response.parse()
+        assert_matches_type(GatewayTokenView, devbox, path=["response"])
+
+    @parametrize
+    async def test_streaming_response_create_gateway_token(self, async_client: AsyncRunloop) -> None:
+        async with async_client.devboxes.with_streaming_response.create_gateway_token(
+            id="id",
+            gateway="gateway",
+            secret="secret",
+        ) as response:
+            assert not response.is_closed
+            assert response.http_request.headers.get("X-Stainless-Lang") == "python"
+
+            devbox = await response.parse()
+            assert_matches_type(GatewayTokenView, devbox, path=["response"])
+
+        assert cast(Any, response.is_closed) is True
+
+    @parametrize
+    async def test_path_params_create_gateway_token(self, async_client: AsyncRunloop) -> None:
+        with pytest.raises(ValueError, match=r"Expected a non-empty value for `id` but received ''"):
+            await async_client.devboxes.with_raw_response.create_gateway_token(
+                id="",
+                gateway="gateway",
+                secret="secret",
+            )
+
     @parametrize
     async def test_method_create_mcp_token(self, async_client: AsyncRunloop) -> None:
         devbox = await async_client.devboxes.create_mcp_token(