Authentication

---

The authenticated setting applies to scaling groups and functions. A function takes the same argument, @chalkcompute.function(authenticated=True), and passes it to the scaling group it runs on.

---

​

Requiring an access token

A scaling group’s web_url is public by default: anyone who has the URL can send requests to it. To require a Chalk access token on every request, set authenticated=True from the SDK or pass --authenticated from the CLI. A request without a valid token gets an HTTP 401 response.

import chalkcompute

img = chalkcompute.Image.debian_slim("3.12").entrypoint(
    ["python", "-m", "http.server", "8080"]
)

sg = chalkcompute.ScalingGroup(
    image=img,
    name="hello-api",
    port=8080,
    authenticated=True,
    startup_probe=chalkcompute.StartupProbe.http("/"),
).deploy()

resp = sg.call("/", method="GET")
print(resp.status)

.call() sends your Chalk access token automatically. Any other client sends the token as a bearer token in the Authorization header. Get a token with chalk token get. In this example, WEB_URL holds the group’s web_url:

$ curl -H "Authorization: Bearer $(chalk token get)" "$WEB_URL/"

Access tokens expire. To request a longer lifetime, pass --expires-in, for example chalk token get --expires-in 24h. The server can cap the lifetime at the maximum allowed for your credentials.

Private routing, which keeps a group off the public internet, requires setup with Chalk. To use it, contact Chalk support.