Metadata-Version: 2.4
Name: arken-client
Version: 0.3.0
Summary: Client SDK for arken-auth — handles the a401 challenge-response flow automatically.
License-Expression: Apache-2.0
Project-URL: Homepage, https://github.com/arkenforge/arken-auth
Project-URL: Repository, https://github.com/arkenforge/arken-auth
Project-URL: Issues, https://github.com/arkenforge/arken-auth/issues
Keywords: arken,did,did:key,authentication,a401,agent,secp256k1
Requires-Python: >=3.9
Description-Content-Type: text/markdown
Requires-Dist: httpx>=0.25.0
Requires-Dist: eth-account>=0.10.0
Requires-Dist: eth-keys>=0.4.0
Requires-Dist: base58>=2.1.0
Provides-Extra: dev
Requires-Dist: pytest>=7.0; extra == "dev"
Requires-Dist: pytest-asyncio>=0.21; extra == "dev"

# arken-client (Python)

Async Python client for [arken-auth](https://github.com/arkenforge/arken-auth).
Handles the a401 challenge-response flow automatically.

## Install

```bash
pip install arken-client
```

> **Pre-1.0:** building from source requires a [Rust toolchain](https://rustup.rs).
> Run `cargo build --release` in `packages/arken-auth-py/rust/` before first use.

## Usage

```python
from arken_client import create_client

client = create_client()                # fresh secp256k1 key pair
print(client.did)                       # did:key:zQ3s...
print(client.private_key_hex)          # persist this to reuse the DID

response = await client.fetch("https://api.example.com/protected")
# automatically handles 401 → sign → retry
```

## Bring your own key

```python
import os
from arken_client import create_client

client = create_client(os.environ["AGENT_PRIVATE_KEY"])
print(client.did)   # deterministic from the key
```

## Security notes

- The client checks that `challenge.audience` matches the hostname of the URL
  being fetched. If they differ it refuses to sign (relay-attack protection).
- The client refuses to sign over plain HTTP unless the host is `localhost`.
  Pass `allow_http=True` only in development.

## License

Apache-2.0
