The SDK supports four authentication methods. If multiple are provided, they follow this priority:
custom_headers_cvar["Authorization"] (overrides everything)authorization_cvar (overrides others and disables automatic token refresh)- Explicit
access_token (if it fails with 401, SDK falls back to OAuth or User/Pass) - OAuth
credentials (used to obtain/refresh token) - Username/password (used to obtain/refresh token)
1. Authorization Key (Recommended)
Use your authorization key. Specify the scope if using B2B or CORP.
2. Username and Password
Requires an explicit base_url that supports the /token endpoint (e.g., https://gigachat.devices.sberbank.ru/api/v1).
3. TLS Certificates (mTLS)
Use client certificates for mutual TLS.
4. Access Token
Use a pre-obtained JWT. Note that access tokens expire after 30 minutes; use this if you manage the lifecycle externally.
# 1. Authorization Key
client = GigaChat(credentials="<your_authorization_key>", scope="GIGACHAT_API_B2B")
# 2. Username and Password
client = GigaChat(base_url="https://gigachat.devices.sberbank.ru/api/v1", user="<username>", password="<password>")
# 3. TLS Certificates (mTLS)
client = GigaChat(base_url="https://gigachat.devices.sberbank.ru/api/v1", cert_file="certs/client.pem", key_file="certs/client.key")
# 4. Access Token
client = GigaChat(access_token="<your_access_token>")