Python SDK - Configuration

NexusConfig is a frozen dataclass holding every value required to construct a client. Pass it to NexusClient.create() or AsyncNexusClient.create() (both accept the same instance).

from westyx_nexus import NexusConfig

config = NexusConfig(
    base_url        = "https://<slug>.westyx.dev",  # required
    api_key         = "wxs_...",                # required
    ttl_seconds     = 60.0,                         # optional, default 60s
    timeout_seconds = 10.0,                         # optional, default 10s
    stream          = True,                         # optional, default True
    logger          = None,                         # optional
)

Field reference

Field	Type	Default	Description
`base_url`	`str`	-	Full service URL, e.g. `https://<slug>.westyx.dev`. The slug embedded in the host is also used as the `Host` header on every request (Double-Gate requirement).
`api_key`	`str`	`""`	Raw `wxs_...` or `wxp_...` key. Sent verbatim in `X-Nexus-API-Key`. Optional when `wif` is enabled. Excluded from the generated `__repr__`, so a traceback rendered with frame locals does not carry it.
`ttl_seconds`	`float \| None`	`60.0`	Local cache TTL in seconds. After this elapses, the next read triggers a one-shot background refresh while still serving the stale cache. (v0.13.0) Zero, negatives and `bool` are rejected at `create()` with a `ValueError` naming the option; `None` means “use the default”.
`timeout_seconds`	`float`	`10.0`	Per-request HTTP timeout in seconds. (v0.2.0) The `/sync` and `/token-exchange` client applies it to every phase. The SSE stream uses a separate client that applies it to connect, write and pool acquisition; the stream’s read deadline is `stream_idle_timeout`, so a short value here cannot truncate a stream that is simply idle.
`stream_idle_timeout`	`float \| None`	`90.0`	(v0.13.0) SSE liveness deadline in seconds: the longest silence - no events, no keepalives - before the connection is declared dead and reconnected. Sized against the server’s 30 s keepalive cadence; every received line resets it, so a healthy stream is never torn down. Zero, negatives and `bool` are rejected at `create()`.
`stream`	`bool`	`True`	Whether to start the SSE live-update stream automatically. Set to `False` to run in pure TTL-polling mode.
`logger`	`NexusLogger \| None`	`None`	Optional logger; `None` discards SDK output. See Custom logging.
`wif`	`WIFConfig \| None`	`None`	(v0.2.0) Workload Identity Federation. When `enabled=True`, the SDK uses bearer auth instead of the API key: most providers exchange a workload credential for a session JWT, and the `developer` provider supplies an already-issued session directly. See Workload identity.
`stream_observer`	`StreamObserver \| None`	`None`	(v0.2.0) Optional structured-callback observer for SSE lifecycle events. See Stream observer.
`sse_reconnect_cooldown`	`int \| list[int] \| None`	`None`	Schedule for reconnecting SSE after falling back to TTL polling. Unit: minutes. `None` = default `[5, 10, 20, 40, 60]` min. `int` = fixed interval. `list[int]` = custom schedule (stays at last value).

WIFConfig fields

Constructed with keyword arguments only. See Workload identity for the full picture.

Field	Type	Default	Description
`enabled`	`bool`	`False`	Master switch. `True` activates WIF.
`provider`	`WIFProvider \| Literal[…] \| None`	`None`	One of `WIFProvider` - or the equivalent string, which is the same value at runtime because the enum is a `StrEnum`. `None` means `"auto"`: probe the environment. A value outside the set raises `ValueError` at construction, naming the valid ones. `"aws_iam"` is never auto-detected.
`exchange_payload`	`ExchangePayloadSource \| None`	`None`	Build the whole token-exchange body yourself. Receives an `ExchangeContext` (`server_id`, `base_url`, `audience`) and returns the request body, so a credential that is not an OIDC token can be expressed. Takes precedence over `token_source` and `provider`.
`token_source`	`TokenSource \| None`	`None`	Produce an OIDC token; the SDK wraps it in the standard body. Sync or async. Takes precedence over `provider` - except with `provider="aws_iam"`, which has no OIDC token and refuses the combination.
`audience`	`str \| None`	`None`	Audience claim requested from GCP / Azure IMDS. The IMDS path requires your app registration’s Application ID URI (`api://<client-id>`); the generic default is refused.
`aws_region`	`str \| None`	`None`	Region for the `aws_iam` STS endpoint. When empty the region comes from the standard AWS chain.

WIFProvider, WIFProviderLiteral, WIFProviderLike, ExchangeContext, ExchangePayloadSource, ExchangeSource, TokenSource, TokenSourceResult and ExchangePayloadResult are all exported from westyx_nexus, so the callbacks the SDK asks for can be named and annotated.

API key types

Prefix	Access	Sync response shape
`wxs_...`	Full - all configs, all secrets, all flags	`configs`, `secrets`, and `flags` populated
`wxp_...`	Restricted - server-filtered configs and flags only	`secrets` field is entirely absent from the response

Calling get_secret(...) with a public key raises NexusPublicKeyError synchronously, before the network call.

Where to keep the API key

Anywhere your existing config pipeline puts secrets - environment variables, AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault, or a local .env file in dev. The SDK never logs the raw key.

import os
config = NexusConfig(
    base_url=os.environ["NEXUS_URL"],
    api_key=os.environ["NEXUS_API_KEY"],
)

For Pydantic / pydantic-settings users:

from pydantic_settings import BaseSettings

class Settings(BaseSettings):
    nexus_url: str
    nexus_api_key: str

settings = Settings()
config = NexusConfig(base_url=settings.nexus_url, api_key=settings.nexus_api_key)

Choosing the TTL

The TTL is a tradeoff between staleness window and redundant network traffic. With SSE enabled (default), changes propagate in milliseconds regardless of the TTL - the TTL only matters as a safety net if the stream falls back.

Use case	Suggested `ttl_seconds`
Frequently-changing flags, latency-sensitive	30.0
Standard configs with SSE	60.0 (default)
Stable production secrets	300.0 (5 min)
Boot-time only, never rechecked	3600.0 (1 hour)

Disabling SSE

config = NexusConfig(
    base_url="...",
    api_key="...",
    stream=False,   # SSE off; use TTL polling only
)

Useful in environments where outbound long-lived connections are blocked (some serverless platforms, certain corporate proxies).

Overview

Backend SDKs

Browser SDKs

OpenFeature Providers

Python SDK - Configuration

Field reference

WIFConfig fields

API key types

Where to keep the API key

Choosing the TTL

Disabling SSE

​Field reference

​WIFConfig fields

​API key types

​Where to keep the API key

​Choosing the TTL

​Disabling SSE

Field reference

WIFConfig fields

API key types

Where to keep the API key

Choosing the TTL

Disabling SSE