feat(sdk): load API key from notte-cli keyring

[leo-notte]

Summary

• resolve SDK API keys from code, NOTTE_API_KEY, then the notte-cli system keyring
• match notte-cli environment-qualified keys and support the legacy production entry
• decode the CLI custom Secret Service representation on Linux and cache the resolved key per client
• document the fallback and add unit coverage

Testing

• uv run ruff check packages/notte-sdk/src/notte_sdk/auth.py packages/notte-sdk/src/notte_sdk/endpoints/base.py tests/sdk/test_sdk_auth.py tests/sdk/test_client.py
• uv run basedpyright packages/notte-sdk/src/notte_sdk/auth.py packages/notte-sdk/src/notte_sdk/endpoints/base.py
• uv run pytest -q tests/sdk/test_sdk_auth.py tests/sdk/test_client.py tests/sdk/test_base_client_version_check.py (48 passed)
• local smoke test with NOTTE_API_KEY unset confirmed NotteClient() loads the notte-cli credential

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• New Features

  • SDK clients can now automatically use API keys saved by notte auth login.
  • API keys are resolved in priority order: explicit configuration, NOTTE_API_KEY, then the system keyring.
  • Resolved credentials are reused across client instances.

• Bug Fixes

  • Improved authentication guidance when no API key is available.

• Documentation

  • Updated Quick Start instructions to explain keyring-based authentication.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c8d2660b-5918-42d9-ba06-4068ea0ba2c4

📥 Commits

Reviewing files that changed from the base of the PR and between 911b51b and 10bca4b.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

• packages/notte-sdk/README.md
• packages/notte-sdk/pyproject.toml
• packages/notte-sdk/src/notte_sdk/auth.py
• packages/notte-sdk/src/notte_sdk/endpoints/base.py
• tests/sdk/test_client.py
• tests/sdk/test_sdk_auth.py

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

Walkthrough

The SDK adds keyring support for notte-cli credentials. It maps API URLs to environments, decodes stored secrets, and resolves keys in explicit, environment, then keyring order. BaseClient caches the resolved key and updates the missing-key error. Documentation and tests cover the new fallback behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 10bca

This change adds SDK API-key fallback to the notte-cli keyring with caching and documentation; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes loading the SDK API key from the notte-cli keyring, which is the main change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/sdk-cli-keyring-fallback

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR adds SDK API-key fallback through credentials saved by notte-cli, preserving explicit argument and environment-variable precedence.

• Adds environment-aware keyring lookup, including Linux Secret Service decoding and legacy production-key support.
• Caches the resolved credential across a client's endpoint clients.
• Adds the keyring dependency, documentation, and focused unit coverage.

Confidence Score: 5/5

The PR appears safe to merge with focused coverage for the new credential-resolution behavior.

The explicit-key and environment-variable precedence remains intact, keyring failures degrade to the existing missing-credential error, and no concrete blocking failure was established in the changed paths.

Important Files Changed

Filename	Overview
packages/notte-sdk/src/notte_sdk/auth.py	Adds environment mapping, CLI credential decoding, platform keyring retrieval, and API-key precedence resolution with best-effort error handling.
packages/notte-sdk/src/notte_sdk/endpoints/base.py	Resolves the server URL before authentication and caches one resolved credential across endpoint clients belonging to the same root client.
packages/notte-sdk/pyproject.toml	Adds keyring as a required SDK dependency, with the corresponding lockfile update.
tests/sdk/test_sdk_auth.py	Covers environment labels, CLI secret decoding, environment and legacy key lookup, precedence, and per-client caching.
tests/sdk/test_client.py	Isolates missing-key initialization from host keyring state while retaining AuthenticationError coverage.
packages/notte-sdk/README.md	Documents the new keyring fallback when explicit and environment credentials are absent.

_{Reviews (1): Last reviewed commit: "feat(sdk): load API key from CLI keyring" | Re-trigger Greptile}

[github-actions]

Tests	Skipped	Failures	Errors	Time
845	32 💤	0 ❌	0 🔥	7m 5s ⏱️