Support access tokens and configurable organization - #25
Merged
FelixAbrahamsson merged 1 commit intoJul 23, 2026
Merged
Conversation
Personal access tokens created in the CVAT UI are not the session blob that create_token() serializes, so AccessToken.deserialize rejected them outright. Fall back to using the token as a credential directly, trying Bearer and then Token since the two flavours are not reliably distinguishable by shape. The organization was hardcoded to NextMLAB, which 404s on any server without that organization. Make it configurable via CVAT_ORGANIZATION and apply it with cvat_sdk's organization_slug; when unset, create_task_ resolves the project's own organization instead of assuming one. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
FelixAbrahamsson
deleted the
support-access-tokens-and-configurable-organization
branch
July 23, 2026 08:53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both changes come from using the self-hosted
cvat.nextml.com(project 104), where the current client cannot authenticate at all.Personal access tokens
Client(token=...)only accepted the base64 session blob produced bycreate_token(), so a personal access token created in the CVAT UI failed withInvalid token formatbefore reaching the server.token_cvat_clientnow falls back to using the token as a credential directly.Which scheme a token wants depends on how it was issued —
POST /api/auth/loginkeys areToken, UI-created access tokens areBearer— and they are not reliably distinguishable by shape, so both are tried againstusers.retrieve_current_user()and whichever the server accepts is kept. A token rejected by both raises an explanatory error rather than a bare 401 later on.Organization
Project.create_task_sent a hardcodedX-Organization: NextMLAB, which 404s withNextMLAB organization does not existon any server without that organization.Client.organizationfield (a slug), settable viaCVAT_ORGANIZATION, applied throughcvat_sdk's ownorganization_slugon both the token and basic auth paths.create_task_resolves the project's organization instead of assuming one, so creating a task in an org-owned project keeps working without configuration.Verification
Client.from_env()againstcvat.nextml.comwith a UI access token now lists project 104's labels and tasks with no workarounds;CVAT_ORGANIZATIONis picked up byfrom_env.create_task_'s org resolution is exercised by the same flow that previously needed a hand-rolledcvat_sdkclient.Note:
tests/test_add_mask.pyfails on this branch, but fails identically onmaster— the checked-in.env.cvat.secretsholdsapp.cvat.aicredentials that now return Unauthorized. Unrelated to these changes.🤖 Generated with Claude Code