Skip to main content

Authentication

Every protected SDK operation sends:

Authorization: Bearer <token>

The token can be either:

  • a personal API token beginning with analog-wakatime_live_
  • a session JWT issued by login or device authorization

Personal API tokens are recommended for scripts and integrations because they can be disabled or deleted independently.

Keep the token outside source code​

Expose the token through the process environment or a deployment secret store:

import Analog_WakaTime_SDK
import os

configuration = Analog_WakaTime_SDK.Configuration(
    access_token=os.environ["ANALOG_WAKATIME_API_TOKEN"],
)

Do not include the literal Bearer prefix. The generated client adds it.

Client lifecycle​

The SDK owns asynchronous HTTP resources. Open it with async with so connections are closed correctly:

import Analog_WakaTime_SDK

async with Analog_WakaTime_SDK.ApiClient(configuration) as api_client:
    profile_api = Analog_WakaTime_SDK.ProfileApi(api_client)
    statistics_api = Analog_WakaTime_SDK.StatisticsApi(api_client)

Reuse one ApiClient for related requests instead of creating a new client for every operation.

Concurrent requests​

Independent reads can run concurrently:

import asyncio

profile, dashboard = await asyncio.gather(
    profile_api.main_api_v1_get_my_profile_info_get(),
    statistics_api.main_api_v1_get_my_dashboard_stats_get(),
)

Security rules​

  • never commit API tokens to Git
  • never place tokens in URLs or query strings
  • do not print tokens in application logs
  • give each integration its own named token
  • disable or delete a token when an integration is retired
  • use HTTPS and keep certificate verification enabled

See personal API-token management for token creation and revocation examples.