Get startedConnect your workspace

Connect your workspace

Connect the SDK to your Welt workspace from a terminal or from Python. You approve access in your browser, so you don't need to copy a key.

Connect from a terminal#

Install the SDK, run this command, then approve the named workspace in your browser:

welt login

Before you approve, the browser shows the permissions requested (read and write) and the key's 30-day lifetime. Read access is required; write access is optional. With read access only, you can inspect and download data, but fitting and prediction need write access.

The key goes back to the waiting SDK once. It is never shown in the browser or in the command output. welt login saves it privately for later Python processes. To revoke it, use your workspace's API keys page.

Connect from a notebook or remote Python#

from welt import Client

with Client() as client:
    client.connect()

Open the printed verification link on your own computer. The short verification code is safe to compare with the one in the browser. Never share a device secret or an API key.

There is no localhost callback and no helper file. connect() keeps access in this Python process, so later Classifier(), Regressor() and Client() calls use the approved origin and credentials. It never changes environment variables.

To keep the connection after the process exits, opt in explicitly:

with Client() as client:
    client.connect(save=True)

If you interrupt the wait, local polling stops; the outstanding browser code expires after ten minutes. Declined, expired, consumed (already used) and unavailable connections raise errors that tell you what to do next.

Which credential the SDK uses#

The SDK uses the first credential it finds, in this order:

1. An explicit api_key.
2. WELT_API_KEY.
3. The most recent connection in this Python process for the exact API origin.
4. A saved credential for that origin.

The origin (the API address) comes from an explicit base_url, then WELT_BASE_URL, then the hosted default. A localhost key or another service's key is never loaded for the hosted origin.

Constructors never sign in, open a browser, create keys or write credentials. connect() checks an existing credential using workspace metadata and reuses it without creating another key. If a credential is invalid or expired, you can reconnect explicitly. If it lacks permissions, you need a key with the right permissions; the SDK doesn't silently replace it.

Where credentials are stored#

On POSIX systems, credentials are stored under ~/.config/welt, with directory mode 0700 and file mode 0600. Set WELT_CONFIG_DIR to choose another private directory. The SDK rejects symlinks and unsafe permissions. It ignores expired saved keys, but their server key stays revocable in the console.

welt login --no-save checks access without saving it. The command's process then exits, so use it only as a connection check.

Manual API-key setup is still available in Account. After you connect, native model availability and permissions still apply: authentication does not qualify every model.

Multiple workspaces#

Name the workspace you want when you connect or when you create a client:

from welt import Client, AsyncClient

client = Client().connect(workspace="acme-research")
# Explicitly persist a revocable workspace credential only when desired:
client.connect(workspace="acme-research", save=True)

with Client(workspace="acme-research") as selected:
    print(selected.workspace())
# Async resources use the same saved selection; browser connection itself is sync.
async_client = AsyncClient(workspace="acme-research")

workspace takes an exact workspace ID or slug. Login requests that workspace and rejects approval of any other.

Constructors select an existing credential without starting login. If there is no credential, they fail with guidance on how to log in. A manual or environment key still takes precedence, and it must match the selected workspace (tenant) before private operations.

Next steps#