> ## Documentation Index > Fetch the complete documentation index at: https://repost.sh/docs/llms.txt > Use this file to discover all available pages before exploring further. # Configure the Python Client > Configure credentials, deadlines, retries, capacity, proxy, DNS, TLS, and mTLS for the Python client. Pass `ClientOptions` when you construct the generated client. The runtime validates and snapshots the options before it accepts sends. ```python theme={"languages":{"custom":["/languages/repost.json"]}} import os from repost_client import ClientOptions from repost_sdk import RepostClient client = RepostClient(ClientOptions( api_key=os.environ.get("REPOST_SEND_API_KEY"), api_url="https://api.repost.sh", operation_timeout_ms=30_000, max_attempts=4, max_in_flight_operations=128, )) ``` ## Credential and endpoint precedence Credential precedence, highest first: `api_key_provider` resolved for each operation, a fixed `api_key`, `REPOST_SEND_API_KEY`, then `REPOST_TOKEN`. `api_key` and `api_key_provider` cannot both be set. With no credential, the send fails with `RepostConfigurationError` and `ErrorCode.CONFIGURATION` before touching the network. Endpoint precedence is an explicit `api_url`, `REPOST_API_URL`, then `https://api.repost.sh`. Plain `http://` is accepted only for loopback hosts. Environment values and every mutable option are copied at construction. Later environment or list mutations do not change that client. ## Defaults All duration options are integer milliseconds. Floats and `datetime.timedelta` values are rejected. | Option | Default | Notes | | -------------------------------------------- | ------------ | ------------------------------------------------------------------------- | | `api_key` | `None` | Fixed credential. Conflicts with `api_key_provider`. | | `api_key_provider` | `None` | Called once per operation; takes precedence over environment credentials. | | `api_url` | `None` | Resolve `REPOST_API_URL`, then `https://api.repost.sh`. | | `connect_timeout_ms` | 10,000 | Connection establishment. | | `attempt_timeout_ms` | 30,000 | One HTTP attempt. | | `operation_timeout_ms` | 120,000 | Whole operation, including retries. | | `max_attempts` | 4 | 1–10 transport attempts before giving up. | | `retry_base_delay_ms` / `retry_max_delay_ms` | 250 / 60,000 | Exponential backoff with full jitter. | | `max_in_flight_operations` | 256 | 1–65,536. New work is rejected when full. | | `max_buffered_bytes` | 67,108,864 | 4 MiB–1 GiB aggregate request and response budget. | | `user_agent_suffix` | `None` | Optional printable ASCII suffix, up to 256 characters. | | `transport` | `None` | Use the built-in raw transport. A custom transport performs one attempt. | | `http_transport_options` | `None` | Default `HTTPTransportOptions`; conflicts with `transport`. | | `generators` | `None` | System timestamp, UUID, and CUID generators. | | `idempotency_key_generator` | `None` | Secure runtime default. | | `retry_entropy` | `None` | Secure runtime full-jitter entropy. | | `monotonic_clock` / `wall_clock` | `None` | System clocks. | | `scheduler` | `None` | Cancellation-aware runtime scheduler. | | `observer` / `telemetry` | `None` | Disabled. See [Observability](/docs/send/python/observability). | The generator, clock, entropy, and scheduler options are deterministic seams intended mainly for tests. The SDK sends the `User-Agent` token `repost-client-python/`. When `user_agent_suffix` is set, one space and the validated suffix are appended. ## Proxy, DNS, TLS, and mTLS ```python theme={"languages":{"custom":["/languages/repost.json"]}} from pathlib import Path from repost_client import ( ClientCertificate, ClientOptions, HTTPTransportOptions, ProxyOptions, TLSOptions, ) from repost_sdk import RepostClient transport = HTTPTransportOptions( proxy=ProxyOptions("http://proxy.internal:8080"), tls=TLSOptions( min_version="TLSv1.2", max_version="TLSv1.3", ca_certificates_pem=[Path("company-ca.pem").read_text()], client_certificate=ClientCertificate( certificate_pem=Path("client.pem").read_text(), key_pem=Path("client-key.pem").read_text(), ), ), http2=True, max_connections_per_origin=32, connection_lifetime_ms=300_000, connection_idle_timeout_ms=120_000, ) client = RepostClient(ClientOptions(http_transport_options=transport)) ``` `ProxyOptions` supports only explicit `http://host:port` CONNECT proxies. When configured, the credential provider is called before CONNECT and its Basic credentials are sent on that first request. The client ignores ambient proxy variables and does not follow redirects. | HTTP transport option | Default | Notes | | ---------------------------- | -------------- | ----------------------------------------------- | | `tls` | `TLSOptions()` | System trust, TLS 1.2 minimum, TLS 1.3 maximum. | | `proxy` | `None` | Direct connection. | | `dns_resolver` | `None` | System resolver. | | `http2` | `True` | Negotiate HTTP/2 with HTTP/1.1 fallback. | | `max_connections_per_origin` | 32 | Per-origin pool bound. | | `connection_lifetime_ms` | 300,000 | Maximum pooled connection lifetime. | | `connection_idle_timeout_ms` | 120,000 | Maximum pooled idle time. | `TLSOptions` uses TLS 1.2 or 1.3 and verifies certificates and hostnames. Custom CA certificates replace the default trust roots. `ClientCertificate` supports an optional passphrase. There is no certificate-verification bypass. A custom `dns_resolver` returns `ResolvedAddress` values when application-controlled DNS is required. It must return promptly; CPython cannot forcibly interrupt a synchronous callback that blocks forever. ## Continue See how deadlines, retries, cancellation, and capacity settle. Attach diagnostics, observers, metrics, and traces. Own one client for the application lifecycle.