docs: sandbox workload identity (IAM tokens) and transform callbacks - #312
docs: sandbox workload identity (IAM tokens) and transform callbacks#312mishushakov wants to merge 2 commits into
Conversation
Documents the new `iam` option on Sandbox.create and the Secret iamToken/iam_token helper from e2b-dev/E2B#1606. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PR SummaryLow Risk Overview Reviewed by Cursor Bugbot for commit aa9fd4f. Bugbot is set up for automated code reviews on this repo. Configure here. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| Each token is scoped to an audience — the external service that will verify it, such as AWS STS — and the service can exchange the token for its own temporary credentials. | ||
|
|
||
| <Note> | ||
| Workload identity is currently available for selected teams. If it's not enabled for your team, sandbox creation with the `iam` option fails with `Sandbox IAM workload tokens are not available for your team.` — [contact us](/docs/support) to get access. |
There was a problem hiding this comment.
Team used instead of project
Medium Severity
Prose uses "teams" / "your team" for the E2B organizational unit; user-facing docs use "project". The quoted API error string can keep "team".
Triggered by learned rule: Use "project" not "team" for the organizational concept — but keep API identifiers unchanged
Reviewed by Cursor Bugbot for commit 9614e54. Configure here.
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
Covers e2b-dev/E2B#1616: transform callbacks receiving iam.tokens placeholders, resolved per request by the egress proxy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
mishushakov
changed the title
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 2 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit aa9fd4f. Configure here.
|
|
||
| The value read from `iam.tokens.<name>` is a placeholder string (`${e2b.identity.tokens.<name>}`) sent on the wire as-is — the egress proxy replaces it with a freshly minted token on each matching request, so the token value never passes through your code or the sandbox. Referencing a name that isn't registered in the sandbox's `iam.tokens` fails at creation with `InvalidArgumentError` (JavaScript) / `InvalidArgumentException` (Python). | ||
|
|
||
| The callback must be synchronous and return a plain transform object — a promise (from an `async` callback) or any other return value is rejected with an error. Static `transform` objects keep working unchanged, including hand-written `${e2b.identity.tokens.<name>}` strings. |
There was a problem hiding this comment.
Em dashes in new docs prose
Low Severity
New docs prose uses em dashes, which violates the house style rule against em dashes and semicolons in documentation prose.
Additional Locations (2)
Triggered by learned rule: No em dashes or semicolons in docs prose (house style)
Reviewed by Cursor Bugbot for commit aa9fd4f. Configure here.
1 participant
Documents sandbox workload identity from e2b-dev/E2B#1606 and the stacked e2b-dev/E2B#1616. Adds a new Workload identity page to the Sandbox group covering the
iamoption onSandbox.create, theSecret.iamToken/Secret.iam_tokenhelper, the plain-object token form, and verified backend constraints (JWT-SVIDonly, requiredaudience, 5-token limit, per-team gating error). Both this page and the internet-access page also documenttransformcallbacks on network rules, which inject registered tokens as${e2b.identity.tokens.<name>}placeholders that the egress proxy resolves per request. Runtime token delivery inside the sandbox is intentionally not documented — it isn't implemented in the public spec yet.🤖 Generated with Claude Code