Skip to content

VB-OS Python SDK Authentication

The SDK provides two client classes with identical interfaces:

  • VBOSClient – synchronous
  • AsyncVBOSClient – asynchronous
from vbos import VBOSClient
client = VBOSClient(
api_key="vbos_your_key_here",
base_url="https://api.vb-os.org", # default
max_retries=3, # default
timeout=30.0, # default, in seconds
)
Parameter Type Default Description
api_key str (required) Your VB-OS API key
base_url str https://api.vb-os.org API base URL
max_retries int 3 Maximum retry attempts for transient failures
timeout float 30.0 Request timeout in seconds

Both client classes support context managers, which automatically close the underlying HTTP connection on exit.

from vbos import VBOSClient
with VBOSClient(api_key="vbos_your_key_here") as client:
result = client.verify(workload={"amount": 500})
print(result.decision)
# Connection closed automatically
import asyncio
from vbos import AsyncVBOSClient
async def main():
async with AsyncVBOSClient(api_key="vbos_your_key_here") as client:
result = await client.verify(workload={"amount": 500})
print(result.decision)
asyncio.run(main())

If you do not use a context manager, call close() when done:

client = VBOSClient(api_key="vbos_your_key_here")
try:
user = client.users.me()
finally:
client.close()

The client retries failed requests automatically:

  • Retried: HTTP 5xx (server errors)
  • Not retried: 4xx client errors (400, 401, 403, 404, 422, 429)
  • Strategy: Exponential backoff with jitter
  • Default: Up to 3 retry attempts

Override the retry count per client:

# Disable retries
client = VBOSClient(api_key="vbos_your_key_here", max_retries=0)
# More aggressive retries
client = VBOSClient(api_key="vbos_your_key_here", max_retries=5)

API keys are scoped to a specific project and environment. Create and manage keys through the console or CLI:

Terminal window
vbos keys create --project my-project --environment production --name "Backend Service"

Store keys securely using environment variables or a secrets manager. Never commit API keys to source control.