dex-sdk

Purpose

Strongly typed Rust client and worker APIs for durable Dex Flows.

Workers

Workers use pull task streams and need only an outbound connection to the Dex Server. WorkerOptions::new() uses pull defaults; WorkerOptions::pull tunes capacity and lifecycle through PullWorkerOptions. Clients route Flows and SubFlows to pull Workers automatically.

API key credentials

When Dex requires access tokens and an application holds an API key, create an ApiKeyCredential before constructing a Client or Worker. Supply the token endpoint URL and the Dex server ID explicitly. Use FileCredential when another process already writes access tokens to a local file.

use std::{sync::Arc, time::Duration};
use dex_sdk::{ApiKeyCredential, ClientOptions, WorkerOptions};

let runtime = tokio::runtime::Runtime::new()?;
let credential = Arc::new(
    runtime.block_on(ApiKeyCredential::builder(token_url, server_id, api_key)
        .exchange_timeout(Duration::from_secs(10))
        .build())?,
);
let client_options = ClientOptions::new().credential(credential.clone());
let worker_options = WorkerOptions::new().credential(credential);

Construction exchanges the key once and fails if the endpoint rejects it. The URL must use HTTPS, except HTTP is allowed on localhost and loopback IP addresses. Each exchange has a ten-second timeout by default. A background task refreshes at 80% of the token lifetime, shares one exchange across callers, and keeps serving a valid token if refresh fails. An expired token fails calls until refresh succeeds. After Dex rejects a unary call, the SDK refreshes and retries it once. Rejected Worker poll streams reconnect once immediately with a fresh token; a second rejection uses the normal Worker backoff. The application owns the credential and may share it among Clients and Workers. Dropping a Client or Worker releases only its reference; dropping the last owner aborts the refresh task. Keep the runtime alive and driving tasks while the credential is in use. A multi-thread runtime does this while it remains alive; a current-thread runtime must be continuously driven. An injected reqwest client builder can configure proxies or private trust roots; the credential disables redirects before building it. The default client uses bundled webpki trust roots. Credential formatting and exchange errors never reveal the API key or an access token.