Authentication

OAuth2 device-flow authentication for the Arena platform. Manages token acquisition, refresh, revocation, and credential persistence.

agilerl.arena.auth.load_credentials(credentials_path: str | PathLike[str] = '~/.arena/credentials.json') → dict[str, Any] | None

Read stored credentials from ~/.arena/credentials.json.

Parameters:

credentials_path (str | os.PathLike[str]) – The path to the credentials file.

Returns:

Token dictionary, or None if absent or malformed.

Return type:

dict[str, Any] | None

class agilerl.arena.auth.ArenaOAuth2

Authentication for the Arena RLOps platform.

Handles authentication with Keycloak. Supports OAuth 2.0 Device Authorization Grant flow.

classmethod configure(*, keycloak_url: str | None = None, realm: str | None = None, client_id: str | None = None, credentials_dir: Path | None = None, credentials_file: Path | None = None) → type[ArenaOAuth2]

Configure the ArenaOAuth2 instance.

Parameters:

  • keycloak_url – The URL of the Keycloak server.

  • realm – The realm to use for authentication.

  • client_id – The client ID to use for authentication.

  • credentials_dir – The directory to store the credentials. Defaults to ~/.arena.

  • credentials_file – The file to store the credentials. Defaults to ~/.arena/credentials.json.

Returns:

The configured ArenaOAuth2 instance.

device_login(timeout: int = 300) → dict[str, Any]

Run the OAuth 2.0 Device Authorization Grant flow.

Requests a device code from Keycloak, opens the verification URL in a browser, then polls until the user authorizes or timeout seconds elapse.

Parameters:

timeout – Maximum seconds to wait for user authorization.

Returns:

Token dict with access_token, refresh_token, etc.

Raises:
refresh_access_token(refresh_token: str) → dict[str, Any]

Obtain a fresh access token using a refresh token.

Persists the updated token set to ~/.arena/credentials.json.

Parameters:

refresh_token – The stored refresh token.

Returns:

Updated token dict.

Raises:

ArenaAuthError – If the refresh is rejected (session expired).

revoke(refresh_token: str) → None

Revoke a Keycloak session and delete stored credentials.

Parameters:

refresh_token – The refresh token to revoke.