Third-Party App Integrations (SDK)

Some functions sign in to a third-party application — Teamwork Cloud, Google Workspace, Windchill, and others — to do their work. Connecting those applications is an administrator task performed in the Istari Digital web app.

Configuring integrations

An organization administrator connects each application once, chooses its sign-in method (OAuth2 / OIDC or Basic), and creates any shared service accounts. See App Integrations in the Administrator Guide for step-by-step setup, including Teamwork Cloud with OIDC, Google Workspace, and a Windchill service account.

Credentials are encrypted at rest and delivered to the agent that runs a job automatically — no key setup is required.

Submitting a job with a stored credential

When a function declares an authentication input, reference one of your stored credentials at submission by passing auth_bindings to add_job. Each binding pairs one of the function's authentication inputs with the credential that should feed it:

from istari_digital_client import NewCredentialBinding

# Pick a stored credential — your linked accounts and any organization
# service accounts both appear here.
credentials = client.list_credentials()
twc_credential = next(c for c in credentials if c.name == "My Teamwork Cloud account")

job = client.add_job(
    model.id,
    "twc_extract",
    auth_bindings=[
        NewCredentialBinding(
            input_name="twc_auth_login",
            credential_id=twc_credential.id,
        )
    ],
)

• input_name is the name of the function's auth_info input, as declared in the module's manifest. Check the function's documentation (or the manifest itself) for the input name it expects.
• credential_id is the ID of a stored credential you can use: one of your own linked accounts or an organization service account. To find it, call client.list_credentials() — it returns every credential available to you, each with an id, a human-readable name (the name shown under Linked Accounts in the web app), and a status. Pass auth_integration_id to narrow the list to one application, and pick the credential by name as in the example above.
• A function with more than one authentication input takes one binding per input.

No secret travels with the submission — a queued job holds no live token. The platform mints a fresh sign-in from the referenced credential only when an agent claims the job, so credentials added or refreshed after submission are picked up automatically.

Model.add_job(...) accepts the same auth_bindings argument. This is the SDK counterpart of the web app's credential picker, described in App Integrations.

Using a credential in a module

If you are building a module that signs in to an external system, declare an authentication input and read the delivered sign-in at run time. See Authenticating to external systems from a module.