developmentseed / developmentseed/obstore
Authentication mechanism for protected earthdata https links
- Dominant language
- Python
- Stars
- 810
- Forks
- 42
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 6
Description
I am not sure if this deserves any special treatment in obstore, but I'll file the issue anyways 😄
NASA makes all of its archived data publicly available via HTTPS links that require an EDL token to access. Here is a basic example of how to do this with obstore:
```python
import os
import requests
from obstore.store import HTTPStore
def get_earthdata_token(username: str, password: str) -> str:
r = requests.post(
"https://urs.earthdata.nasa.gov/api/users/find_or_create_token",
auth=(username, password),
)
r.raise_for_status()
return r.json()["access_token"]
token = get_earthdata_token(
os.getenv("EARTHDATA_USERNAME"),
os.getenv("EARTHDATA_PASSWORD"),
)
url = "https://data.lpdaac.earthdatacloud.nasa.gov/lp-prod-protected"
store = HTTPStore(
url,
client_options={
"default_headers": {
"Authorization": f"Bearer {token}",
}
},
)
store.head("ECO_L2T_STARS.002/ECOv002_L2T_STARS_20FPJ_20180709_0712_01/ECOv002_L2T_STARS_20FPJ_20180709_0712_01_NDVI.tif")
```
```
{'path': 'ECO_L2T_STARS.002/ECOv002_L2T_STARS_20FPJ_20180709_0712_01/ECOv002_L2T_STARS_20FPJ_20180709_0712_01_NDVI.tif',
'last_modified': datetime.datetime(2025, 2, 19, 7, 57, 25, tzinfo=datetime.timezone.utc),
'size': 217222,
'e_tag': '"3bb863cba40abe7bb8184e5033c32ca9-1"',
'version': None}
```
This is not too much work but I wonder if it would be useful to create a NasaEarthdataHTTPCredentialProvider that could handle all of the token logic for the user provide the `Auth: Bearer xxxx` header to the HTTPStore when making requests. These tokens are really long-lived (60 days?) so token refreshes are not a concern.
Maybe this is not worth any code changes and a docs example would suffice!
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the HTTPStore and its client_options default_headers example in the issue, then determine whether the requested NASA Earthdata token handling belongs in a credential provider or documentation. Done means a documented or implemented way to access the protected Earthdata HTTPS URL with its Bearer token.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authentication
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100