StrongDM ID Python SDK

factory.strongdm.ai

Python SDK for StrongDM ID - Identity infrastructure for AI agents with OAuth/OIDC and DPoP support.

Features

• Agent Authentication: OAuth 2.0 with DPoP (RFC 9449) sender-constrained tokens
• Enrollment Flows: Self-enrollment and sponsored enrollment
• Token Management: Acquire, refresh, exchange, and revoke tokens
• Token Exchange: Delegation support (RFC 8693)
• Share Grants: Create and manage access shares
• MCP Server Integration: Authenticate MCP servers with StrongDM ID

Installation

pip install strongdm-id

Or install from source:

git clone https://github.com/your-org/strongdm-id.git
cd strongdm-id
pip install -e .

Quick Start

1. Get Credentials (First Time Only)

If you don't have credentials yet, enroll a new agent:

python examples/enroll_agent.py

This will:

• Request enrollment with your email
• Wait for verification code from email
• Save credentials to .env and ~/.strongdm/credentials/

Or enroll programmatically:

from strongdm_id import enroll_self, confirm_enrollment, load_config

config = load_config(issuer_url="https://id.strongdm.ai")
result = enroll_self(
    email="user@example.com",
    client_name="My Agent",  # Optional
    config=config
)
# Check email for verification code
confirm_enrollment(
    enrollment_id=result["enrollment_id"],
    verification_code="123456",
    poll_token=result["poll_token"],
    config=config
)

2. Acquire Token

from strongdm_id import load_config, acquire_token

# Load from .env or environment variables
config = load_config()

# Or pass credentials directly
config = load_config(
    client_id="your_client_id",
    client_secret="your_client_secret"
)

token_data = acquire_token(config=config, scopes=["openid", "profile"])
print(f"Access token: {token_data['access_token']}")

MCP Server with Authentication

from mcp_server import create_mcp_server, start_server
from mcp_server.middleware import require_auth

config = {
    "issuer_url": "https://id.strongdm.ai",
    "expected_audience": "my-mcp-server"
}

server = create_mcp_server(config=config)

@require_auth(required_scopes=["read:resources"])
def handle_list_resources(request, auth_context):
    return {"user": auth_context["sub"], "resources": [...]}

start_server(server)

Configuration

Configure via environment variables or pass directly to functions:

export STRONGDM_ISSUER_URL=https://id.strongdm.ai
export STRONGDM_CLIENT_ID=your_client_id
export STRONGDM_CLIENT_SECRET=your_client_secret

See .env.example for all configuration options.

Documentation

• API Reference
• Examples
• StrongDM ID Documentation

Development

# Install with dev dependencies
pip install -e ".[dev]"

# Run tests
pytest

# Format code
black .

# Type checking
mypy strongdm_id

License

MIT License