Asynchronous identity_token_provider to WorkloadIdentityCredentials

[jheiss]

I have an asynchronous application which uses Workload Identity Federation within AWS to communicate with the Anthropic API. The identity_token_provider function I provide to WorkloadIdentityCredentials needs to make a network call to the AWS STS to get a token. I would like to be able to provide an async function so that I can make that call in a way that is compatible with how the rest of my app works. That does not appear to be supported currently.

[karatarassul4-max]

I traced this through the current credentials path. IdentityTokenProvider is currently Callable[[], str], and WorkloadIdentityCredentials.call() invokes it synchronously. The async client avoids blocking the event loop by running TokenCache.get_token() through asyncify() in a worker thread, so simply accepting an awaitable provider would not be sufficient without introducing an async credential/token-cache path.

Would you prefer native async provider support here, or is running the existing synchronous provider in the async client's worker thread considered the intended behavior? If native async support is desired, I'd be happy to work on it with regression coverage

[jheiss]

@karatarassul4-max Oh, interesting that the code already has some async support. Good find! So I could provide a synchronous function to WorkloadIdentityCredentials identity_token_provider and it would be called asynchronously in a thread. I suppose that is good enough, at least for now.

But given that the SDK does have the top level AsyncAnthropic client and the underlying httpx library actually doing the communication also supports async, including for the authentication callback, it seems a shame to not have real async authentication support in this library.

I’m sure there are multiple ways to construct this, but as a first pass it seems like there needs to be an async alternative to AccessTokenProvider, let’s call it AsyncAccessTokenProvider. AsyncAnthropic could take AccessTokenProvider|AsyncAccessTokenProvider for credentials. Then this gets a little messy because I think you need an AsyncTokenCache which invokes the provider with await. Perhaps you could have AsyncTokenCache subclass TokenCache and restructure things so that you aren’t just duplicating all of TokenCache’s logic? And then finally AccessTokenAuth could have a conditional in async_auth_flow where if self._token_cache is an AsyncTokenCache it can await get_token rather than using asyncify. (Or make an AsyncAccessTokenAuth that only takes AsyncTokenCache, but AsyncAnthropic might want to support synchronous credential providers for backwards compatibility.)

[jheiss]

Just noticed that @achandmsft suggested something similar in #1496. (He's requesting a simpler alternative to the credentials= parameter for Anthropic/AsyncAnthropic but likewise suggesting that it support async.)