> **Building with AI coding agents?** Install the authstack plugin with one command. This equips your agent with accurate Scalekit implementation patterns.
>
> **Recommended**:
> ```bash
> npx @scalekit-inc/cli setup
> ```
>
> Global:
> ```bash
> npm install -g @scalekit-inc/cli
> scalekit setup
> ```
>
> Supports Claude Code, Cursor, GitHub Copilot, Codex + skills for 40+ agents.
> Features: full-stack-auth, agent-auth, mcp-auth, modular-sso, modular-scim.
> [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/)

---

# Create client

Create the SDK client and run core auth helpers
<div class="sdk-client-page">

Create a `ScalekitClient` with your environment URL, client ID, and client secret. All other clients hang off this instance.

Store credentials in environment variables. Never hard-code secrets. After you create the client, use [Sessions](/saaskit/sdks/python/sessions/) to work with sessions or open a domain client such as [Organizations](/saaskit/sdks/python/organization/) or [Users](/saaskit/sdks/python/user/).

### get_authorization_url
<div class="sdk-method-section">
  
    
      

      Method to get authorization URL

      
        Redirect URI for SAML SSO
      
      
        Auth URL options object
      
      
        Authorization URL
      

```python wrap showLineNumbers=false

from scalekit import AuthorizationUrlOptions

# Security: generate a per-login OAuth state and store it in the session.
# Comparing the returned state on callback prevents login CSRF.
options = AuthorizationUrlOptions()
options.state = secrets.token_urlsafe(32)
options.organization_id = 'org_123456'
# request.session['oauth_state'] = options.state

auth_url = scalekit_client.get_authorization_url(
    'https://yourapp.com/auth/callback',
    options
)
# Redirect user to auth_url
```

    
  
</div>

### authenticate_with_code
<div class="sdk-method-section">
  
    
      

      Method to authenticate with code options

      
        authorization_code
      
      
        Redirect URI
      
      
        CodeAuthenticationOptions Object
      
      
        Tokens and claims.
      

```python wrap showLineNumbers=false
from scalekit import ScalekitClient

@app.get('/auth/callback')
async def auth_callback(request):
    code = request.query_params.get('code')
    state = request.query_params.get('state')

    # Security: reject the callback if state does not match the session value.
    if state != request.session.get('oauth_state'):
        return {'error': 'invalid state'}, 400

    result = scalekit_client.authenticate_with_code(
        code,
        'https://yourapp.com/auth/callback'
    )

    request.session['access_token'] = result['access_token']
    request.session['user'] = result['user']

    return RedirectResponse('/dashboard')
```

    
  
</div>

### get_idp_initiated_login_claims
<div class="sdk-method-section">
  
    
      

      Method to get IDP initiated login claims

      
        IDP initiated login token
      
      
        Optional request settings.
      
      
        Token audience.
      
      
        ``` IdpInitiatedLoginClaims ```
      
```python wrap showLineNumbers=false
@app.get('/auth/callback')
async def auth_callback(request):
    idp_initiated_login = request.query_params.get('idp_initiated_login')

    if idp_initiated_login:
        claims = scalekit_client.get_idp_initiated_login_claims(idp_initiated_login)

        options = AuthorizationUrlOptions()
        options.connection_id = claims['connection_id']
        options.organization_id = claims['organization_id']
        options.login_hint = claims.get('login_hint')
        if claims.get('relay_state'):
            options.state = claims['relay_state']

        auth_url = scalekit_client.get_authorization_url(
            'https://yourapp.com/auth/callback',
            options
        )

        return RedirectResponse(auth_url)
```
    
  
</div>

### validate_access_token
<div class="sdk-method-section">
  
    
      

      Method to validate access token

      
        access token
      
      
        Optional request settings.
      
      
        Token audience.
      
      
        bool
      

```python wrap showLineNumbers=false
is_valid = scalekit_client.validate_access_token(token)
if is_valid:
    # Token is valid, proceed with request
    pass
```
    
  
</div>

### get_logout_url
<div class="sdk-method-section">
  
    
      

      Method to get logout URL

      
        Logout URL options object
      
      
        str: The logout URL
      

```python wrap showLineNumbers=false
options = LogoutUrlOptions()
options.post_logout_redirect_uri = 'https://example.com'
options.state = 'some-state'

logout_url = scalekit_client.get_logout_url(options)
```
    
  
</div>

### verify_webhook_payload
<div class="sdk-method-section">
  
    
      

      Method to verify webhook payload

      
        Secret for webhook verification
      
      
        Webhook request headers
      
      
        Webhook payload in str or bytes
      
      
        bool
      

```python wrap showLineNumbers=false

@app.post('/webhooks')
async def webhook_handler(request):
    payload = await request.body()
    headers = dict(request.headers)
    # Security: load the webhook secret from configuration — never hard-code it.
    # Skipping signature verification accepts forged webhook payloads as legitimate.
    secret = os.environ['SCALEKIT_WEBHOOK_SECRET']

    is_valid = scalekit_client.verify_webhook_payload(secret, headers, payload)

    if not is_valid:
        return {'error': 'invalid signature'}, 401

    # Process verified webhook
    return {'ok': True}
```
    
  
</div>

### refresh_access_token
<div class="sdk-method-section">
  
    
      

      Method to refresh access token using refresh token

      
        Refresh token to get new access token
      
      
        dict with access token & refresh token
      

```python wrap showLineNumbers=false
result = scalekit_client.refresh_access_token(refresh_token)
new_access_token = result['access_token']
new_refresh_token = result['refresh_token']
```

    
  
</div>

### generate_client_token
<div class="sdk-method-section">
  
    
      

      Method to generate access token

      
        Client Id for access token
      
      
        Client Secret for access token
      
      
        OAuth scopes.
      
      
        access token
      

    
  
</div>

### get_client_access_token
<div class="sdk-method-section">
  
    
      

      Method to generate an access token using the stored client credentials.

      
        access token string
      

    
  
</div>

### validate_access_token_and_get_claims
<div class="sdk-method-section">
  
    
      

      Method to validate access token and get claims

      
        access token
      
      
        Optional request settings.
      
      
        Token audience.
      
      
        claims
      

    
  
</div>

### validate_token
<div class="sdk-method-section">
  
    
      

      Method to validate token

      
        token
      
      
        Optional request settings.
      
      
        Optional. audience for validation
      
      
        payload
      

    
  
</div>

### verify_scopes
<div class="sdk-method-section">
  
    
      

      Verify that the token contains the required scopes

      
        The token to verify
      
      
        The scopes that must be present in the token
      
      
        bool: Returns True if all required scopes are present
      

    
  
</div>

### verify_interceptor_payload
<div class="sdk-method-section">
  
    
      

      Method to verify interceptor payload using common verification logic

      
        Secret for interceptor verification
      
      
        Headers.
      
      
        Interceptor payload in str or bytes
      
      
        bool
      

    
  
</div>

</div>


---

## More Scalekit documentation

| Resource | What it contains | When to use it |
|----------|-----------------|----------------|
| [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content |
| [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas |
| [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |