Drive Streamlit Desk from your own code

# A guest token. This is the ONLY call that names the slug - every later
# call identifies the app from the token itself.
curl -s -X POST https://api.skillsafe.ai/v1/app-api/guest \
  -H 'Content-Type: application/json' \
  -d '{"slug":"streamlit-desk"}'

# -> { "ok": true, "data": { "token": "aut_...", "guest_id": "gst_..." } }
# Keep the token. A personal token from /tokens.html works the same way and
# spends your own credits instead of a guest wallet.

import requests

BASE = "https://api.skillsafe.ai/v1/app-api"

def guest_token():
    r = requests.post(BASE + "/guest", json={"slug": "streamlit-desk"}, timeout=30)
    r.raise_for_status()
    return r.json()["data"]["token"]

TOKEN = guest_token()          # or paste one from /tokens.html
HEAD = {"Authorization": "Bearer " + TOKEN, "Content-Type": "application/json"}

def call(method, path, body=None, headers=None):
    h = dict(HEAD)
    h.update(headers or {})
    r = requests.request(method, BASE + path, json=body, headers=h, timeout=180)
    payload = r.json()
    if not payload.get("ok"):
        raise RuntimeError(payload["error"]["code"] + ": " + payload["error"]["message"])
    return payload["data"]

const BASE = "https://api.skillsafe.ai/v1/app-api";

async function guestToken() {
  const r = await fetch(BASE + "/guest", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ slug: "streamlit-desk" })
  });
  const p = await r.json();
  if (!p.ok) throw new Error(p.error.code + ": " + p.error.message);
  return p.data.token;
}

const TOKEN = await guestToken();   // or paste one from /tokens.html

async function call(method, path, body, extraHeaders) {
  const r = await fetch(BASE + path, {
    method,
    headers: Object.assign({
      Authorization: "Bearer " + TOKEN,
      "Content-Type": "application/json"
    }, extraHeaders || {}),
    body: body ? JSON.stringify(body) : undefined
  });
  const p = await r.json();
  if (!p.ok) throw new Error(p.error.code + ": " + p.error.message);
  return p.data;
}

package main

import (
    "bytes"
    "encoding/json"
    "errors"
    "io"
    "net/http"
)

const Base = "https://api.skillsafe.ai/v1/app-api"

type envelope struct {
    OK    bool            `json:"ok"`
    Data  json.RawMessage `json:"data"`
    Error *struct {
        Code    string `json:"code"`
        Message string `json:"message"`
    } `json:"error"`
}

func guestToken() (string, error) {
    body, _ := json.Marshal(map[string]string{"slug": "streamlit-desk"})
    res, err := http.Post(Base+"/guest", "application/json", bytes.NewReader(body))
    if err != nil {
        return "", err
    }
    defer res.Body.Close()
    raw, _ := io.ReadAll(res.Body)
    var env envelope
    if err := json.Unmarshal(raw, &env); err != nil {
        return "", err
    }
    if !env.OK {
        return "", errors.New(env.Error.Code + ": " + env.Error.Message)
    }
    var d struct {
        Token string `json:"token"`
    }
    json.Unmarshal(env.Data, &d)
    return d.Token, nil
}

import java.net.URI;
import java.net.http.*;

public class StreamlitDesk {
    static final String BASE = "https://api.skillsafe.ai/v1/app-api";
    static final HttpClient HTTP = HttpClient.newHttpClient();
    static String token;

    static String guestToken() throws Exception {
        HttpRequest req = HttpRequest.newBuilder(URI.create(BASE + "/guest"))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString("{\"slug\":\"streamlit-desk\"}"))
            .build();
        String body = HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
        // Parse with your JSON library of choice and read data.token
        return extract(body, "token");
    }
}

require "net/http"
require "json"
require "uri"

BASE = "https://api.skillsafe.ai/v1/app-api"

def guest_token
  uri = URI(BASE + "/guest")
  res = Net::HTTP.post(uri, { slug: "streamlit-desk" }.to_json,
                       "Content-Type" => "application/json")
  payload = JSON.parse(res.body)
  raise "#{payload["error"]["code"]}: #{payload["error"]["message"]}" unless payload["ok"]
  payload["data"]["token"]
end

TOKEN = guest_token   # or paste one from /tokens.html

<?php
const BASE = "https://api.skillsafe.ai/v1/app-api";

function post_json(string $path, array $body, array $headers = []): array {
    $ch = curl_init(BASE . $path);
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => array_merge(["Content-Type: application/json"], $headers),
        CURLOPT_POSTFIELDS => json_encode($body),
    ]);
    $payload = json_decode(curl_exec($ch), true);
    curl_close($ch);
    if (empty($payload["ok"])) {
        throw new RuntimeException($payload["error"]["code"] . ": " . $payload["error"]["message"]);
    }
    return $payload["data"];
}

$token = post_json("/guest", ["slug" => "streamlit-desk"])["token"];
$auth = ["Authorization: Bearer " . $token];

using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;

const string Base = "https://api.skillsafe.ai/v1/app-api";
var http = new HttpClient();

async Task<string> GuestTokenAsync() {
    var body = new StringContent("{\"slug\":\"streamlit-desk\"}",
                                 Encoding.UTF8, "application/json");
    var res = await http.PostAsync(Base + "/guest", body);
    using var doc = JsonDocument.Parse(await res.Content.ReadAsStringAsync());
    if (!doc.RootElement.GetProperty("ok").GetBoolean())
        throw new Exception(doc.RootElement.GetProperty("error").GetProperty("code").GetString());
    return doc.RootElement.GetProperty("data").GetProperty("token").GetString()!;
}

var token = await GuestTokenAsync();   // or paste one from /tokens.html
http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

curl -s https://api.skillsafe.ai/v1/app-api/me -H "Authorization: Bearer YOUR_TOKEN"

# -> { "ok": true, "data": {
#        "subject_type": "guest",      # or "user" once signed in
#        "credits": 48210,
#        "app": { "slug": "streamlit-desk", "model_alias": "gpt-terra" } } }

me = call("GET", "/me")
print(me["subject_type"], me["credits"])

const me = await call("GET", "/me");
console.log(me.subject_type, me.credits);

req, _ := http.NewRequest("GET", Base+"/me", nil)
req.Header.Set("Authorization", "Bearer "+token)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()

HttpRequest me = HttpRequest.newBuilder(URI.create(BASE + "/me"))
    .header("Authorization", "Bearer " + token)
    .GET().build();
System.out.println(HTTP.send(me, HttpResponse.BodyHandlers.ofString()).body());

uri = URI(BASE + "/me")
req = Net::HTTP::Get.new(uri, "Authorization" => "Bearer #{TOKEN}")
me = JSON.parse(Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }.body)["data"]
puts me["subject_type"], me["credits"]

$ch = curl_init(BASE . "/me");
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => $auth]);
$me = json_decode(curl_exec($ch), true)["data"];
curl_close($ch);
echo $me["subject_type"], " ", $me["credits"], PHP_EOL;

var meRes = await http.GetStringAsync(Base + "/me");
using var meDoc = JsonDocument.Parse(meRes);
var me = meDoc.RootElement.GetProperty("data");
Console.WriteLine(me.GetProperty("credits").GetInt32());

# Free. No job is created and nothing is billed.
curl -s -X POST https://api.skillsafe.ai/v1/app-api/estimate \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"task": "review","script": "import streamlit as st\nimport pandas as pd\nst.title(\"Sales\")\nst.set_page_config(layout=\"centered\")\ndf = pd.read_csv(\"sales.csv\")\nregion = st.selectbox(\"Region\", [\"EU\", \"US\"])\nst.write(df[df.region == region])\nst.write(\"Total: \" + str(st.session_state.total))","st_version": "current","deploy_target": "internal","notes": "","prescan_facts": { "looks_streamlit": true, "flags": [] }}'

# -> { "ok": true, "data": {
#        "model": "gpt-5.6-terra", "model_alias": "gpt-terra",
#        "markup_bps": 1000, "hold_credits": 3140, "min_credits": 420,
#        "sponsor_enabled": false } }
#
# hold_credits is a RESERVATION priced at the full output cap, not the price.
# It differs per lane, so re-estimate whenever you change `task`.

SCRIPT = open("app.py", encoding="utf-8").read()

def payload(task, **extra):
    body = {
        "task": task,
        "script": SCRIPT[:26000],
        "st_version": "current",
        "deploy_target": "internal",
        "notes": "",
        "prescan_facts": {"looks_streamlit": True, "flags": []},
    }
    body.update(extra)
    return body

est = call("POST", "/estimate", payload("review"))
print(est["model"], est["model_alias"], est["hold_credits"], "reserved")
assert est["model_alias"] == "gpt-terra"

const script = await (await fetch("/app.py")).text();

const payload = (task, extra = {}) => Object.assign({
  task,
  script: script.slice(0, 26000),
  st_version: "current",
  deploy_target: "internal",
  notes: "",
  prescan_facts: { looks_streamlit: true, flags: [] }
}, extra);

const est = await call("POST", "/estimate", payload("review"));
console.log(est.model_alias, est.hold_credits, "reserved");

body, _ := json.Marshal(map[string]any{
    "task":          "review",
    "script":        script,
    "st_version":    "current",
    "deploy_target": "internal",
    "prescan_facts": map[string]any{"looks_streamlit": true, "flags": []any{}},
})
req, _ := http.NewRequest("POST", Base+"/estimate", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()

String body = """
    {"task":"review","script":"...","st_version":"current",
     "deploy_target":"internal",
     "prescan_facts":{"looks_streamlit":true,"flags":[]}}
    """;
HttpRequest est = HttpRequest.newBuilder(URI.create(BASE + "/estimate"))
    .header("Authorization", "Bearer " + token)
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(body)).build();
System.out.println(HTTP.send(est, HttpResponse.BodyHandlers.ofString()).body());

def payload(task, script)
  { task: task, script: script[0, 26_000], st_version: "current",
    deploy_target: "internal", notes: "",
    prescan_facts: { looks_streamlit: true, flags: [] } }
end

uri = URI(BASE + "/estimate")
req = Net::HTTP::Post.new(uri, "Authorization" => "Bearer #{TOKEN}",
                               "Content-Type" => "application/json")
req.body = payload("review", File.read("app.py")).to_json
est = JSON.parse(Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }.body)["data"]
puts est["hold_credits"]

function payload(string $task, string $script): array {
    return [
        "task" => $task,
        "script" => substr($script, 0, 26000),
        "st_version" => "current",
        "deploy_target" => "internal",
        "notes" => "",
        "prescan_facts" => ["looks_streamlit" => true, "flags" => []],
    ];
}

$est = post_json("/estimate", payload("review", file_get_contents("app.py")), $auth);
echo $est["model_alias"], " reserves ", $est["hold_credits"], PHP_EOL;

object Payload(string task, string script) => new {
    task,
    script = script.Length > 26000 ? script[..26000] : script,
    st_version = "current",
    deploy_target = "internal",
    notes = "",
    prescan_facts = new { looks_streamlit = true, flags = Array.Empty<object>() }
};

var estBody = new StringContent(JsonSerializer.Serialize(Payload("review", script)),
                                Encoding.UTF8, "application/json");
var estRes = await http.PostAsync(Base + "/estimate", estBody);
Console.WriteLine(await estRes.Content.ReadAsStringAsync());

# The Idempotency-Key must include the LANE. Two lanes over the same script
# are two distinct runs; reusing one key across them returns the first reply.
KEY="streamlit-desk:review:$(shasum -a 256 app.py | cut -c1-16):a1"

JOB=$(curl -s -X POST https://api.skillsafe.ai/v1/app-api/run \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $KEY" \
  -d @input.json | python3 -c 'import json,sys;print(json.load(sys.stdin)["data"]["job_id"])')

# Poll to a terminal state.
until [ "$(curl -s https://api.skillsafe.ai/v1/app-api/jobs/$JOB -H "Authorization: Bearer YOUR_TOKEN" \
       | python3 -c 'import json,sys;print(json.load(sys.stdin)["data"]["status"])')" != "running" ]; do
  sleep 2
done

curl -s https://api.skillsafe.ai/v1/app-api/jobs/$JOB -H "Authorization: Bearer YOUR_TOKEN"
# -> data.output.output holds the JSON object described above, as a string.

import hashlib, json, time

def idem(task, script, attempt=1):
    h = hashlib.sha256(script.encode()).hexdigest()[:16]
    return f"streamlit-desk:{task}:{h}:a{attempt}"

def run(task, **extra):
    body = payload(task, **extra)
    job = call("POST", "/run", body,
               {"Idempotency-Key": idem(task, body["script"])})
    while True:
        state = call("GET", "/jobs/" + job["job_id"])
        if state["status"] != "running":
            break
        time.sleep(2)
    if state["status"] != "succeeded":
        raise RuntimeError(state.get("error") or state["status"])
    # The model returns one JSON object as text.
    return json.loads(state["output"]["output"]), state

result, meta = run("review")
print(result["verdict"], len(result["findings"]), "findings")
print("charged", meta.get("charged_credits"), "credits")

import { createHash } from "node:crypto";

const idem = (task, script, attempt = 1) =>
  `streamlit-desk:${task}:${createHash("sha256").update(script).digest("hex").slice(0, 16)}:a${attempt}`;

async function run(task, extra = {}) {
  const body = payload(task, extra);
  const job = await call("POST", "/run", body,
    { "Idempotency-Key": idem(task, body.script) });
  let state;
  do {
    state = await call("GET", "/jobs/" + job.job_id);
    if (state.status === "running") await new Promise(r => setTimeout(r, 2000));
  } while (state.status === "running");
  if (state.status !== "succeeded") throw new Error(state.error || state.status);
  return [JSON.parse(state.output.output), state];
}

const [result, meta] = await run("review");
console.log(result.verdict, result.findings.length, "findings");

sum := sha256.Sum256([]byte(script))
key := fmt.Sprintf("streamlit-desk:review:%x:a1", sum[:8])

req, _ = http.NewRequest("POST", Base+"/run", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Idempotency-Key", key)
res, _ = http.DefaultClient.Do(req)
// read data.job_id, then GET /jobs/{id} until status != "running"

String key = "streamlit-desk:review:" + sha256(script).substring(0, 16) + ":a1";
HttpRequest run = HttpRequest.newBuilder(URI.create(BASE + "/run"))
    .header("Authorization", "Bearer " + token)
    .header("Content-Type", "application/json")
    .header("Idempotency-Key", key)
    .POST(HttpRequest.BodyPublishers.ofString(body)).build();
String jobId = extract(HTTP.send(run, HttpResponse.BodyHandlers.ofString()).body(), "job_id");
// then poll GET /jobs/{jobId} until status != "running"

require "digest"

def idem(task, script, attempt = 1)
  "streamlit-desk:#{task}:#{Digest::SHA256.hexdigest(script)[0, 16]}:a#{attempt}"
end

uri = URI(BASE + "/run")
req = Net::HTTP::Post.new(uri,
  "Authorization" => "Bearer #{TOKEN}",
  "Content-Type" => "application/json",
  "Idempotency-Key" => idem("review", script))
req.body = payload("review", script).to_json
job = JSON.parse(Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }.body)["data"]
# then GET /jobs/#{job["job_id"]} until status != "running"

function idem(string $task, string $script, int $attempt = 1): string {
    return "streamlit-desk:$task:" . substr(hash("sha256", $script), 0, 16) . ":a$attempt";
}

$job = post_json("/run", payload("review", $script),
    array_merge($auth, ["Idempotency-Key: " . idem("review", $script)]));
// then GET /jobs/{$job["job_id"]} until status != "running"

string Idem(string task, string script, int attempt = 1) {
    var hash = Convert.ToHexString(
        System.Security.Cryptography.SHA256.HashData(Encoding.UTF8.GetBytes(script)));
    return $"streamlit-desk:{task}:{hash[..16].ToLowerInvariant()}:a{attempt}";
}

var runReq = new HttpRequestMessage(HttpMethod.Post, Base + "/run") {
    Content = new StringContent(JsonSerializer.Serialize(Payload("review", script)),
                                Encoding.UTF8, "application/json")
};
runReq.Headers.Add("Idempotency-Key", Idem("review", script));
var runRes = await http.SendAsync(runReq);
// then GET /jobs/{job_id} until status != "running"

curl -N -s -X POST https://api.skillsafe.ai/v1/app-api/run-stream \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: streamlit-desk:pages:abc123:a1" \
  -d @input.json

# Server-sent events:
#   event: job    data: {"job_id":"job_..."}
#   event: delta  data: {"text":"{\"task\":\"pages\","}
#   ...
#   event: done   data: {"status":"succeeded","charged_credits":2870,"truncated":false}
#
# Concatenate every delta's `text` to rebuild the JSON object. If the stream
# dies mid-flight, whatever you have is still worth parsing - the web app
# renders the sections that arrived rather than discarding them.

import httpx

def run_stream(task, **extra):
    body = payload(task, **extra)
    raw = []
    headers = dict(HEAD)
    headers["Idempotency-Key"] = idem(task, body["script"])
    with httpx.stream("POST", BASE + "/run-stream", json=body,
                      headers=headers, timeout=300) as r:
        for line in r.iter_lines():
            if line.startswith("data: "):
                event = json.loads(line[6:])
                if "text" in event:
                    raw.append(event["text"])
    return "".join(raw)

text = run_stream("pages")
result = json.loads(text[text.index("{"):text.rindex("}") + 1])

const res = await fetch(BASE + "/run-stream", {
  method: "POST",
  headers: {
    Authorization: "Bearer " + TOKEN,
    "Content-Type": "application/json",
    "Idempotency-Key": idem("pages", script)
  },
  body: JSON.stringify(payload("pages"))
});

const reader = res.body.pipeThrough(new TextDecoderStream()).getReader();
let raw = "";
for (;;) {
  const { value, done } = await reader.read();
  if (done) break;
  for (const line of value.split("\n")) {
    if (!line.startsWith("data: ")) continue;
    const event = JSON.parse(line.slice(6));
    if (event.text) raw += event.text;
  }
}
const result = JSON.parse(raw.slice(raw.indexOf("{"), raw.lastIndexOf("}") + 1));

req, _ = http.NewRequest("POST", Base+"/run-stream", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Idempotency-Key", key)
res, _ = http.DefaultClient.Do(req)
defer res.Body.Close()

scanner := bufio.NewScanner(res.Body)
var sb strings.Builder
for scanner.Scan() {
    line := scanner.Text()
    if strings.HasPrefix(line, "data: ") {
        var ev struct{ Text string `json:"text"` }
        json.Unmarshal([]byte(line[6:]), &ev)
        sb.WriteString(ev.Text)
    }
}

HttpRequest stream = HttpRequest.newBuilder(URI.create(BASE + "/run-stream"))
    .header("Authorization", "Bearer " + token)
    .header("Content-Type", "application/json")
    .header("Idempotency-Key", key)
    .POST(HttpRequest.BodyPublishers.ofString(body)).build();

StringBuilder raw = new StringBuilder();
HTTP.send(stream, HttpResponse.BodyHandlers.ofLines()).body()
    .filter(line -> line.startsWith("data: "))
    .forEach(line -> raw.append(textField(line.substring(6))));

uri = URI(BASE + "/run-stream")
req = Net::HTTP::Post.new(uri,
  "Authorization" => "Bearer #{TOKEN}",
  "Content-Type" => "application/json",
  "Idempotency-Key" => idem("pages", script))
req.body = payload("pages", script).to_json

raw = +""
Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(req) do |res|
    res.read_body do |chunk|
      chunk.each_line do |line|
        next unless line.start_with?("data: ")
        event = JSON.parse(line[6..])
        raw << event["text"] if event["text"]
      end
    end
  end
end

$ch = curl_init(BASE . "/run-stream");
$raw = "";
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => array_merge($auth, [
        "Content-Type: application/json",
        "Idempotency-Key: " . idem("pages", $script),
    ]),
    CURLOPT_POSTFIELDS => json_encode(payload("pages", $script)),
    CURLOPT_WRITEFUNCTION => function ($ch, $chunk) use (&$raw) {
        foreach (explode("\n", $chunk) as $line) {
            if (str_starts_with($line, "data: ")) {
                $event = json_decode(substr($line, 6), true);
                if (isset($event["text"])) { $raw .= $event["text"]; }
            }
        }
        return strlen($chunk);
    },
]);
curl_exec($ch);
curl_close($ch);

var streamReq = new HttpRequestMessage(HttpMethod.Post, Base + "/run-stream") {
    Content = new StringContent(JsonSerializer.Serialize(Payload("pages", script)),
                                Encoding.UTF8, "application/json")
};
streamReq.Headers.Add("Idempotency-Key", Idem("pages", script));

var streamRes = await http.SendAsync(streamReq, HttpCompletionOption.ResponseHeadersRead);
using var reader = new StreamReader(await streamRes.Content.ReadAsStreamAsync());
var raw = new StringBuilder();
while (await reader.ReadLineAsync() is { } line) {
    if (!line.StartsWith("data: ")) continue;
    using var ev = JsonDocument.Parse(line[6..]);
    if (ev.RootElement.TryGetProperty("text", out var t)) raw.Append(t.GetString());
}