Authentication and configuration

Resolve API keys and the API base URL through explicit arguments, environment variables, or CLI configuration.

Create the credential in Unitlab

Workspace API key creation entry point

Workspace Settings › API keys is the credential issuance surface. Create a key there, copy it directly into an approved secret manager, and never reveal it in documentation, logs, command history, or screenshots.

Outcome: Resolve API keys and the API base URL through explicit arguments, environment variables, or CLI configuration.

Credential precedence

UnitlabClient resolves configuration in this order:

1. Explicit api_key or api_url constructor argument.

2. UNITLAB_API_KEY or UNITLAB_API_URL environment variable.

3. Values written by unitlab configure.

If no API key is found, the constructor raises AuthenticationError before making a request.

export UNITLAB_API_KEY="YOUR_API_KEY"
export UNITLAB_API_URL="https://api.unitlab.ai"

from unitlab import UnitlabClient

client = UnitlabClient()
try:
    print(client.projects.list())
finally:
    client.close()

For a developer workstation, the CLI can persist configuration:

unitlab configure --api-key "$UNITLAB_API_KEY"
unitlab configure --api-url "https://api.unitlab.ai"

Use a workspace-owned service identity where possible. Rotate keys on an explicit schedule and immediately after suspected exposure.

Operating contract

Concern	Required behavior
Execution surface	Pinned unitlab==3.0.0 application environment on Python 3.10+.
Identity	Least-privilege API key supplied through approved configuration.
Target resolution	Stable resource IDs and an explicitly bounded target set.
Success evidence	Typed return fields, server-side state, and downstream acceptance of the result.

Failure and recovery boundary

Condition	Response
Authentication or authorization fails	Stop, correct the service identity or access model, rotate exposed credentials, and rerun a read-only check.
Validation or entitlement rejects the operation	Correct the input or entitlement; do not retry an unchanged request.
A request times out	Inspect remote state before repeating a mutation because the server may have accepted it.
Asynchronous processing exceeds its deadline	Preserve the Batch Queue or release ID, continue bounded monitoring, and inspect item-level failures.
Only part of a batch succeeds	Keep successful identifiers, isolate failed rows, and retry only the corrected subset.

Pin and test the production SDK version. Use stable IDs, keep secrets out of logs and command history, and record the correlation ID, target IDs, counts, final state, and redacted error details for material state changes.

---

Continue with Unitlab: Unitlab’s data annotation platform