SDKs

One authorization check. Any language.

Official SDKs for Go, Node.js and Python. One call to authorize a request. Works with the Vengtoo cloud endpoint or the local Vengtoo Agent. Swap between them in one line.

Read the docs →Get Started

Go

github.com/vengtoo/vengtoo-go

go get github.com/vengtoo/vengtoo-go

Node.js

@vengtoo/sdk

npm install @vengtoo/sdk

Python

vengtoo

pip install vengtoo

Go

Authorize in two lines of Go.

The Go SDK wraps the evaluation API with a typed client. Includes net/http middleware, and supports batch evaluation for checking multiple access decisions in one call.

  • ✓net/http middleware helper
  • ✓Batch evaluation
  • ✓OAuth2 client credentials for service-to-service
  • ✓Context propagation for tracing
Go
import vengtoo "github.com/vengtoo/vengtoo-go"

client := vengtoo.NewClient("your-api-key")

result, err := client.Evaluate(ctx, &vengtoo.EvaluationRequest{
    Subject:  vengtoo.Subject{Type: "user", ID: "user_42"},
    Resource: vengtoo.Resource{Type: "document", ID: "q4_report"},
    Action:   vengtoo.Action{Name: "read"},
})

if err != nil || !result.Decision {
    http.Error(w, "Forbidden", http.StatusForbidden)
    return
}

// --- net/http middleware ---
authz := client.HTTPMiddleware("document", "read",
    func(r *http.Request) (vengtoo.Subject, error) {
        return vengtoo.Subject{Type: "user", ID: r.Header.Get("X-User-ID")}, nil
    })
mux.Handle("/documents/", authz(documentHandler))
Node.js
import { Vengtoo } from '@vengtoo/sdk'

const client = new Vengtoo({ apiKey: process.env.VENGTOO_API_KEY })

const result = await client.evaluate({
  subject:  { type: 'user', id: req.user.id },
  resource: { type: 'document', id: req.params.docId },
  action:   { name: 'read' },
})

if (!result.decision) {
  return res.status(403).json({ error: 'Forbidden' })
}

// --- Express middleware ---
// The third argument resolves the caller from the request.
app.use('/documents', client.middleware('document', 'read', (req) => ({ external_id: req.user.id, type: 'user' })))

Node.js

TypeScript-first. Express in one call.

The Node SDK is fully typed. Call client.evaluate() anywhere, or drop in the Express middleware to protect entire route groups.

  • ✓Full TypeScript types
  • ✓Express middleware
  • ✓Works with any HTTP framework via client.evaluate()
  • ✓Promise-based, works in async/await and callback styles

Python

Sync and async. FastAPI ready.

The Python SDK supports both sync and async usage. The FastAPI dependency makes it trivial to add authorization to any route.

  • ✓Sync and async client (httpx under the hood)
  • ✓FastAPI dependency helper
  • ✓Pydantic models for all request/response types
  • ✓Works in Django, Flask, or plain Python
Python
from vengtoo import Vengtoo, Subject, Resource, Action, EvaluationRequest

client = Vengtoo(api_key="your-api-key")

result = client.evaluate(EvaluationRequest(
    subject=Subject(type="user", id="user_42"),
    resource=Resource(type="document", id="q4_report"),
    action=Action(name="read"),
))

if not result.decision:
    raise HTTPException(status_code=403, detail="Forbidden")

# --- FastAPI dependency ---
@app.get("/documents/{doc_id}")
async def get_document(
    doc_id: str,
    _: None = Depends(client.require(
        "document", "read",
        lambda req: Subject(type="user", id=req.headers["x-user-id"]),
    )),
):
    ...

Local agent

Point at the agent. Nothing else changes.

All three SDKs accept a baseUrl option. Set it to your local Vengtoo Agent and every call is served on your own infrastructure, with no round-trip to the cloud. The API, types, and middleware helpers are identical.

All languages — one change
// Go
client := vengtoo.NewClient("",
    vengtoo.WithBaseURL("http://localhost:8181"))

// Node.js
const client = new Vengtoo({
    baseUrl: 'http://localhost:8181',
})

# Python
client = Vengtoo(base_url="http://localhost:8181")