developmentseed / developmentseed/obstore

Authentication mechanism for protected earthdata https links

Open
#680 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
810
Forks
42
Avg merge
1d 15h
Merged PRs (30d)
6

Description

I am not sure if this deserves any special treatment in obstore, but I'll file the issue anyways 😄

NASA makes all of its archived data publicly available via HTTPS links that require an EDL token to access. Here is a basic example of how to do this with obstore:

```python
import os

import requests
from obstore.store import HTTPStore

def get_earthdata_token(username: str, password: str) -> str:
r = requests.post(
"https://urs.earthdata.nasa.gov/api/users/find_or_create_token",
auth=(username, password),
)
r.raise_for_status()
return r.json()["access_token"]

token = get_earthdata_token(
os.getenv("EARTHDATA_USERNAME"),
os.getenv("EARTHDATA_PASSWORD"),
)

url = "https://data.lpdaac.earthdatacloud.nasa.gov/lp-prod-protected"
store = HTTPStore(
url,
client_options={
"default_headers": {
"Authorization": f"Bearer {token}",
}
},
)

store.head("ECO_L2T_STARS.002/ECOv002_L2T_STARS_20FPJ_20180709_0712_01/ECOv002_L2T_STARS_20FPJ_20180709_0712_01_NDVI.tif")
```

```
{'path': 'ECO_L2T_STARS.002/ECOv002_L2T_STARS_20FPJ_20180709_0712_01/ECOv002_L2T_STARS_20FPJ_20180709_0712_01_NDVI.tif',
'last_modified': datetime.datetime(2025, 2, 19, 7, 57, 25, tzinfo=datetime.timezone.utc),
'size': 217222,
'e_tag': '"3bb863cba40abe7bb8184e5033c32ca9-1"',
'version': None}
```

This is not too much work but I wonder if it would be useful to create a NasaEarthdataHTTPCredentialProvider that could handle all of the token logic for the user provide the `Auth: Bearer xxxx` header to the HTTPStore when making requests. These tokens are really long-lived (60 days?) so token refreshes are not a concern.

Maybe this is not worth any code changes and a docs example would suffice!

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the HTTPStore and its client_options default_headers example in the issue, then determine whether the requested NASA Earthdata token handling belongs in a credential provider or documentation. Done means a documented or implemented way to access the protected Earthdata HTTPS URL with its Bearer token.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.