feat(sdk): add iam workload identity option and Secret.iamToken helper

[mishushakov]

Implements the sandbox workload identity (IAM) feature from the infra spec (SandboxIam / SandboxIamTokens / SandboxIamToken, already present in the pinned spec and generated clients) across the JS SDK and the sync and async Python SDKs. Sandbox.create gains an iam option whose non-empty tokens map enables workload identity, and a new Secret class (exported from both main packages) provides iamToken / iam_token to define the token values, per the SDK design. The design doc's filePath field is deliberately omitted until it lands in the OpenAPI spec, and plain { audience, tokenType } objects are accepted alongside Secret.iamToken results. The SDK builds the request body from only the known token fields (stray properties never reach the wire, undefined-valued map entries count as empty) and rejects tokens missing audience/tokenType (token_type in Python) with InvalidArgumentError / InvalidArgumentException. Covered by request-body tests (msw in JS, NewSandbox payload tests in Python) since the backend feature is team-gated; all three surfaces were also smoke-tested end-to-end against production, where the payload is parsed and answered with the expected team-gating error.

Fixes SDK-245.

Usage

import { Sandbox, Secret } from 'e2b'

const sandbox = await Sandbox.create({
  iam: {
    tokens: {
      aws: Secret.iamToken({ audience: 'sts.amazonaws.com', tokenType: 'JWT-SVID' }),
    },
  },
})

from e2b import Sandbox, Secret

sandbox = Sandbox.create(
    iam={
        "tokens": {
            "aws": Secret.iam_token(audience="sts.amazonaws.com", token_type="JWT-SVID"),
        },
    },
)

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: d472461

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
e2b	Minor
@e2b/python-sdk	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

PR Summary

Medium Risk
Touches workload identity on sandbox create (security-sensitive), but changes are SDK request shaping and validation against an existing API with good test coverage.

Overview
Adds sandbox workload identity to the JS and Python SDKs (sync and async): Sandbox.create accepts an optional iam config with a named tokens map (audience + tokenType / token_type). A non-empty map is sent on create; empty or missing config is omitted from the request body.

Introduces exported Secret with iamToken / iam_token helpers; plain token objects work too. buildIamBody / build_iam_config validate required fields, strip extra keys (e.g. undeclared filePath), and reject malformed entries with clear client errors.

Covered by MSW tests (JS) and NewSandbox payload tests (Python); changeset bumps e2b and @e2b/python-sdk as minor.

^{Reviewed by Cursor Bugbot for commit d472461. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Package Artifacts

Built from 8a79081. Download artifacts from this workflow run.

JS SDK (e2b@2.36.1-iam-sdk-feature.0):

npm install ./e2b-2.36.1-iam-sdk-feature.0.tgz

CLI (@e2b/cli@2.15.2-iam-sdk-feature.0):

npm install ./e2b-cli-2.15.2-iam-sdk-feature.0.tgz

Python SDK (e2b==2.35.0+iam.sdk.feature):

pip install ./e2b-2.35.0+iam.sdk.feature-py3-none-any.whl

[linear-code]

SDK-245