Aembit Edge SDKs
The Aembit Edge SDKs are language libraries that wrap the Aembit Edge API. Your application authenticates a workload and retrieves credentials through a few method calls, without hand-rolling HTTP requests or managing token lifecycles. The SDK runs inside your application process, so there’s nothing extra to deploy or operate alongside it.
The SDKs are available for TypeScript and Python.
When to use an SDK
Section titled “When to use an SDK”The Developer Guide overview compares all four ways to get a credential into a workload: Agent Proxy, the Edge SDK, the Aembit CLI, and the Edge API.
Choose an SDK when you can change the application’s source and you want credential retrieval to be explicit in your code. It suits environments where running a proxy next to the workload isn’t practical, such as serverless functions, ephemeral CI containers, and platforms where you don’t control the runtime.
If changing application code isn’t an option, Agent Proxy reaches the same outcome by intercepting traffic instead. That path trades code changes for components you deploy and operate.
What the SDKs handle for you
Section titled “What the SDKs handle for you”An SDK covers the same three steps you’d otherwise implement yourself against the Edge API:
- Workload attestation. The SDK collects identity evidence from the environment it runs in, such as a cloud instance identity document or an OIDC token, and presents that evidence to Aembit. Aembit verifies it against the Trust Provider: Trust Providers validate Client Workload identities through workload attestation, verifying identity claims from the workload's runtime environment rather than relying on pre-shared secrets.Learn more you configured.
- Token lifecycle. The SDK caches the resulting access token in memory and refreshes it before it expires, so repeated calls don’t re-authenticate.
- Credential retrieval. The SDK requests a credential for the service your application needs to reach. Aembit returns one only if an Access Policy: Access Policies define, enforce, and audit access between Client and Server Workloads by cryptographically verifying workload identity and contextual factors rather than relying on static secrets.Learn more permits that access.
The SDKs use the same Aembit primitives as every other access path, so the console-side configuration is familiar. You configure a Trust Provider to verify the workload’s identity and a Credential Provider: Credential Providers obtain the specific access credentials—such as API keys, OAuth tokens, or temporary cloud credentials—that Client Workloads need to authenticate to Server Workloads.Learn more to supply the credential. An Access Policy then authorizes a specific Client Workload: Client Workloads represent software applications, scripts, or automated processes that initiate access requests to Server Workloads, operating autonomously without direct user interaction.Learn more to reach a specific Server Workload: Server Workloads represent target services, APIs, databases, or applications that receive and respond to access requests from Client Workloads.Learn more, using those providers.
Supported Trust Providers
Section titled “Supported Trust Providers”You can use the Edge SDK with the following Trust Providers:
- AWS Metadata Service Trust Provider
- AWS Role Trust Provider
- Azure Instance Metadata Service Trust Provider
- GCP Identity Token Trust Provider
- GitHub Trust Provider
- GitLab Trust Provider
- OIDC ID Token Trust Provider
Not every provider is available in both languages. For per-language coverage, see Edge SDK Trust Providers.
Where to go next
Section titled “Where to go next”
SDK repositoryInstallation, the developer reference, and runnable examples for each supported environment.
→
Edge APIThe REST interface the SDKs wrap, including the authentication and credential endpoints.
→
Trust ProvidersConfigure how Aembit verifies the identity your workload presents.
→