Documentation
DocumentationAPI ReferenceRelease Notes
DocumentationLog In
Documentation

Using the Python SDK on SageMaker

How to install and initialize the Deepchecks Python SDK when running on AWS SageMaker - authentication, environment variables, and the SigV4 signing flow.

The Deepchecks Python SDK works the same way on SageMaker as it does on SaaS - the same methods for logging interactions, uploading datasets, and downloading results. What differs is authentication: on SageMaker, the SDK authenticates using AWS SigV4 signing instead of a plain API token, and it reads configuration from a set of AWS-provided environment variables.

This page walks through the SageMaker-specific setup. For general SDK usage (batch upload, stream upload, field reference), see Python SDK Integration.

What you need

Before running the SDK on SageMaker, make sure you have:

  • A running Deepchecks Partner AI App in your SageMaker environment (see Deepchecks in AWS SageMaker)
  • The three values from the Deepchecks app launch page:
    • API Key - generated from within the Deepchecks app
    • ARN (Amazon Resource Name) - shown on the Partner AI App page
    • SDK URL (AWS Partner App URL) - shown on the Partner AI App page
  • An environment with AWS credentials available (IAM role on SageMaker notebooks, or ~/.aws/credentials when running locally)

Installation

Install the SDK inside your SageMaker JupyterLab notebook or local Python environment:

pip install deepchecks-llm-client

The same deepchecks-llm-client package is used for SaaS and SageMaker - no separate package.

Authentication: how it works

On SaaS, the SDK authenticates with a bearer API token. On SageMaker, Deepchecks is a Partner AI App, so requests must be signed using AWS Signature Version 4 (SigV4). The SDK handles this automatically when it detects it is running in a SageMaker context - you don't have to sign requests yourself.

The SDK detects SageMaker mode by checking the AWS_PARTNER_APP_AUTH environment variable. When set, it:

  • Uses AWS credentials (from the IAM role or ~/.aws/credentials) to sign each request with SigV4
  • Sends your Deepchecks API key in the x-amz-partner-app-authorization header
  • Adds the Partner App ARN in the x-mlapp-sm-app-server-arn header

Initialization

Option 1: Environment variables (recommended)

Set these environment variables in your notebook or shell, then initialize the client with no arguments:

import os
from deepchecks_llm_client.client import DeepchecksLLMClient

os.environ["AWS_PARTNER_APP_AUTH"] = "True"
os.environ["AWS_PARTNER_APP_ARN"] = "arn:aws:sagemaker:us-west-2:123456789012:partner-app/..."
os.environ["AWS_PARTNER_APP_URL"] = "https://<your-sdk-url>"
os.environ["DEEPCHECKS_LLM_API_TOKEN"] = "your-api-key"

# AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are typically provided automatically
# by the SageMaker IAM role. Set them explicitly only if running outside SageMaker.

dc_client = DeepchecksLLMClient()

SageMaker sets AWS_PARTNER_APP_URL automatically in certain contexts; if it is already present, you can skip setting it manually.

Option 2: Explicit arguments

You can also pass api_token and host directly:

from deepchecks_llm_client.client import DeepchecksLLMClient

dc_client = DeepchecksLLMClient(
    api_token="your-api-key",
    host="https://<your-sdk-url>",
)

The host value is the SDK URL from your Partner AI App launch page. Even with explicit arguments, you still need AWS_PARTNER_APP_AUTH=True set in the environment so the SDK uses SigV4 signing.

Verify the connection

Once initialized, run a quick check to confirm everything works:

# Create an application (safe to re-run - skips if it already exists)
from deepchecks_llm_client.data_types import ApplicationType

dc_client.create_application("My App", app_type=ApplicationType.QA)

# List applications to confirm auth
apps = dc_client.get_applications()
print(apps)

If authentication is misconfigured, you will see a 401 or 403 error - check the ARN, SDK URL, and API token values against the Deepchecks Partner AI App page.

Using the SDK

Once the client is initialized, every other SDK call works identically to SaaS. See these pages for the actual data upload flows:

Reference

Updated 14 days ago