Authentication

Setup

Install Rebase Toolkit and authenticate this computer:

pip install rebase-toolkit
rebase setup

rebase setup signs you in with Google or GitHub, creates or selects a workspace, and writes a local auth session plus workspace profile on this computer. The SDK reads that session automatically when you use rb.project(...), rb.get_function(...), rb.get_workflow(...), or rb.workspace().

The hosted Rebase API URL is built into rebase-toolkit. Users should not set an API URL for normal usage.

Bearer Tokens

The SDK sends the stored user session access token as a bearer token. The health and setup-config API routes are public. Workspace, project, function, workflow, model, endpoint management, and run API routes require a valid bearer token when auth is enabled.

The API resolves that user token to a Rebase profile and one active workspace membership. Use X-Rebase-Workspace only when the same user has access to multiple workspaces and needs to target a non-default workspace.

Workspace Invites

Workspace owners can invite collaborators by email address or GitHub username:

rebase workspace invite davide@rebase.energy --role Developer
rebase workspace invite davide-github --role Developer

List active members and pending invites:

rebase workspace members

Roles are Viewer, Developer, Admin, and Owner. A pending invite becomes a workspace membership when the invited user signs in with a matching email address or GitHub username.

API Keys

API keys are separate from the normal user sign-in flow. They are intended for direct API access and agent/service use cases where an interactive Google or GitHub sign-in is not appropriate.

API key secrets start with rb_. The service stores only key hashes and shows only the key prefix after creation. API keys are scoped to a workspace, and may also be scoped to a project and permission set.

Create an agent key:

rebase api-key create notebook

The default agent key grants read access to workspace metadata, projects, functions, workflows, models, and runs, plus endpoint read and execute permissions. The command prints the one-time secret. Store it securely; it cannot be retrieved again.

List and revoke keys:

rebase api-key list
rebase api-key revoke <id-or-prefix-or-name>

For direct API-key access, pass the key explicitly to the client:

import rebase as rb

client = rb.Client(api_key="rb_...")
print(client.get_workspace())

Only the key hash is stored by the service.

Endpoint Auth

Endpoints choose their invocation auth separately from endpoint management:

Use auth="api_key" for agents and service-to-service calls. Use auth="workspace" when signed-in users should call the endpoint through rebase endpoint invoke or the SDK's normal profile credentials.

Local Development

The Toolkit API can run with auth disabled. In that mode, requests use the configured default workspace and no bearer token is required.

Workspace Isolation

Every authenticated request resolves to a workspace. For user auth, the workspace comes from the selected workspace membership. For API keys, it comes from the key record.

Every API key has:

If a caller requests a project, function, workflow, model, endpoint, version, or run outside its workspace, the API returns 404.

SDK Configuration

The SDK reads the selected local profile:

import rebase as rb

project = rb.project("energy-forecasting")

Use profiles when you need separate credentials:

rebase setup --profile prod

rebase workspace switch prod

Workspace Profiles

To work across multiple workspaces, store one local profile per workspace:

rebase setup --profile acme
rebase setup --profile internal

Show the active workspace profile:

rebase workspace

List configured workspace profiles:

rebase workspace list

Switch the default workspace profile:

rebase workspace switch acme