SDK quickstart — Go + Python

trustmint ships client SDKs in two languages so integrators on either stack write less integration code. The SDKs handle the FGAI-HMAC AK/SK signing (the part that is NOT AWS SigV4 — see registration) and a generated typed-error surface. This page is a front door; the SDK source + READMEs are the authoritative reference.

These are the backend-integration SDKs (your factory-service ↔ ThingMake). The device-side SDKs that implement the on-device DDI-1 wire contract are distributed separately — see Device SDKs. Don’t look for device SDKs here.

Source of truth

Artifact

What it is

sdks/README.md

Top-level SDK guide — first 5 minutes, AK/SK wire scheme, example matrix, Makefile targets

sdks/go/

Go SDK (generated client + signing/ transport)

sdks/python/

Python SDK (generated client + auth/ signers)

sdks/examples/

Four runnable example scenarios per language, plus a Python factory-integration gate

The SDKs are generated from the ThingMake OpenAPI snapshot (rendered on the API reference page) and the error catalog thingmake-error-catalog.json — do not hand-fork them.

First 5 minutes

The reusable half of the SDK is the signer: it turns an ordinary HTTP client into one that signs every request with FGAI-HMAC. Wrap your client, point it at the public API host, and call a capability path.

// Go — wrap any http.Client
client := &http.Client{
    Transport: signing.NewSigningTransport(accessKeyID, secretKey, nil),
}
resp, err := client.Get("https://api.flexgalaxy.ai/provisioning/v1/factory-services")

# Python — httpx or requests
import httpx
from thingmake_sdk.auth import AKSKAuth

client = httpx.Client(base_url="https://api.flexgalaxy.ai",
                      auth=AKSKAuth(access_key_id, secret_key))
resp = client.get("/provisioning/v1/factory-services")

Use https://api.staging.flexgalaxy.ai for the same API one release ahead while you are still integrating. Both hosts speak the identical contract. The per-SDK READMEs (sdks/go/README.md, sdks/python/README.md) document the generated client types on top of the signer.

The example matrix

The example programs are reading material first: each one is a complete, commented implementation of one scenario, and each is wired to a local fixture rather than to the public host, so copy the shape rather than running them against production.

#

Scenario

Auth

Go

Python

01

Register a factory-service (capture one-time AK/SK)

bearer token

sdks/go/examples/01-register-factory-service/

sdks/python/examples/01-register-factory-service/

02

Receive a state-change notification (subscription + webhook listener)

AK/SK

sdks/go/examples/02-receive-state-notification/

sdks/python/examples/02-receive-state-notification/

03

Poll state changes via cursor (cursor loop, 410 recovery)

AK/SK

sdks/go/examples/03-poll-state-changes/

sdks/python/examples/03-poll-state-changes/

04

Verify a webhook signature (host the receiver + call the verify helper)

webhook secret

sdks/go/examples/04-verify-webhook/

sdks/python/examples/04-verify-webhook/

05

Factory-integration gate (end-to-end identify/provision round trip)

AK/SK

—

sdks/python/examples/05-factory-integration-gate/

Example 01 mints an interactive bearer token, registers the factory-service, and writes the one-time {access_key_id, secret_access_key} to a git-ignored .aksk.env. Examples 02 / 03 / 04 read ACCESS_KEY_ID and SECRET_ACCESS_KEY from it. Never commit .aksk.env — it holds your secret-key.

Generated client surface

The generated Go/Python clients are regenerated from the OpenAPI snapshot and cover the device-model registry under the registry capability:

  • /registry/v1/vendors

  • /registry/v1/models

  • /registry/v1/models/{id}

  • /registry/v1/software

  • /registry/v1/software/{id}

The CLI reference lists the full capability groups a credential can reach; the API reference is the endpoint-level contract. Treat a method’s presence in a generated client as availability, and those two pages as the supported surface.

What next