Downloads

ScaiLog Go SDK 1.0.1 — source distribution. Same SDK code as the 1.0.0 line (per-entry tenancy, _global namespace)

ScaiKey Go SDK **v1.0.1** — first usable release. Full admin, directory, OAuth/OIDC and webhook coverage, with no third-party dependencies. > **1.0.0 is superseded and should not be used.** It declared the module path > `github.com/scailabs/scaikey-go`, which does not resolve — `go get` against it > fails. 1.0.1 is identical in behaviour and corrects the module path to > `scailabs.ai/scaikey-go`. No API changes. Requires Go 1.22 or later. Module path `scailabs.ai/scaikey-go`. Download the tarball below, unpack it, and reference it with a `replace` directive in your `go.mod` — or vendor the source directly: ```go require scailabs.ai/scaikey-go v1.0.1 replace scailabs.ai/scaikey-go => ./scaikey-go-1.0.1 ``` The `replace` directive is interim: the module path is stable and will resolve through `go get` once ScaiLabs' own git environment serves it, at which point you drop that line and nothing else changes. ### Standard library only The SDK imports nothing outside the Go standard library. Adding it cannot pull a dependency tree into your build or collide with your existing version pins — a direct response to the Storey team's report that SDK dependencies were harder to accommodate than the SDK itself. ### What's covered | Area | Surface | |---|---| | Directory | `Users`, `Groups` (direct + effective members, nested and parent groups) | | Tenancy | `Tenants`, `Partners` | | Applications | list, get, create, update, delete, rotate secret, effective users | | Federation | `IdentityProviders` — list, get, sync, test connection | | Operations | `Sessions` (list, revoke), `Audit` | | Public | unauthenticated application lookup | | OAuth / OIDC | PKCE, authorization code, refresh, client credentials, userinfo, introspection, revocation, discovery (cached 15 min), RP-initiated logout | | Webhooks | HMAC-SHA256 signature verification with replay protection | Every call takes a `context.Context`. Errors are typed — `NotFoundError`, `AuthorizationError`, `RateLimitError` and the rest — and match with `errors.As`, all embedding `*APIError` for status code, error code and raw body. ### Logout is modelled explicitly `OAuthClient.LogoutURL()` builds the OIDC end-session URL for the correct realm. This is deliberate: ScaiKey serves six routes with "logout" in the path, four of which are POST-only portal APIs. Sending a browser to one of those returns 405 and the user is never signed out — a failure integrating teams have actually hit. The SDK makes that unreachable. The doc comment states the three things that make logout work, because each has caused a real incident: redirect the browser rather than calling it server-side (a back-channel request carries no SSO cookie), send `IDTokenHint` so refresh tokens can be revoked, and remember that access tokens are **not** revoked because they are self-contained JWTs. ### Base URLs and realm paths Pass the **origin**. A base URL already carrying an API prefix (`/api/v1`, `/api/v1/platform`, ...) is accepted and reduced, so configurations copied from older documentation keep working. The realm asymmetry is modelled explicitly rather than guessed at: | | discovery | jwks | |---|---|---| | tenant | `/api/v1/auth/tenants/<slug>/.well-known/openid-configuration` | `.../.well-known/jwks.json` | | platform | `/api/v1/platform/`**`oauth`**`/.well-known/openid-configuration` | `/api/v1/platform/.well-known/jwks.json` | Note the trap: platform discovery carries an `oauth` segment and platform jwks does not, so a blanket rule fixes one and breaks the other. Both are pinned by unit tests. (ScaiKey has since begun serving platform discovery at both paths; the SDK uses the `oauth` form so it keeps working against older instances.) ### Live contract tests ```bash SCAIKEY_BASE_URL=https://scaikey.scailabs.ai \ SCAIKEY_TENANT_SLUG=<slug> \ go test -run Contract -v ./... ``` Four SDK releases across three languages were rolled back for what was, every time, a model-vs-endpoint disagreement — a path the SDK built that the server did not serve, or a field the SDK expected that the response did not carry. Unit tests cannot see any of that. The suite asserts that every URL the SDK constructs resolves to a real route (a 401 or 403 proves routing succeeded; a 404 is the bug), that both discovery documents resolve *and* every endpoint they advertise resolves, that the end-session endpoint answers a GET with a redirect, and that list envelopes decode into non-empty models. It was verified to fail on regression, not merely to pass: injecting a wrong admin path produced *"route does not exist (404): the SDK builds a path this server does not serve"*, and pointing logout at a portal route produced *"rejected GET with 405 (Allow: POST) — a browser redirect cannot log anyone out"*. Webhook signing was cross-checked against the server's own algorithm: a signature produced by the platform's implementation verifies in Go. ### Documentation <https://www.scailabs.ai/docs/scaikey/tutorials/web-app-login-and-logout>