datasette-auth-tokens 0.1.1

Datasette plugin for authenticating access using API tokens

datasette-auth-tokens

Datasette plugin for authenticating access using API tokens

Installation

Install this plugin in the same environment as Datasette.

$ pip install datasette-auth-tokens

Usage

Read about Datasette's authentication and permissions system.

This plugin lets you configure secret API tokens which can be used to make authenticated requests to Datasette.

First, create a random API token. A useful recipe for doing that is the following:

$ python -c 'import secrets; print(secrets.token_hex(32))'
5f9a486dd807de632200b17508c75002bb66ca6fde1993db1de6cbd446362589

Decide on the actor that this token should represent, for example:

{
    "bot_id": "my-bot"
}

You can then use "allow" blocks to provide that token with permission to access specific actions. To enable access to a configured writable SQL query you could use this in your metadata.json:

{
    "plugins": {
        "datasette-auth-tokens": [
            {
                "token": {
                    "$env": "BOT_TOKEN"
                },
                "actor": {
                    "bot_id": "my-bot"
                }
            }
        ]
    },
    "databases": {
        ":memory:": {
            "queries": {
                "show_version": {
                    "sql": "select sqlite_version()",
                    "allow": {
                        "bot_id": "my-bot"
                    }
                }
            }
        }
    }
}

This uses Datasette's secret configuration values mechanism to allow the secret token to be passed as an environment variable.

Run Datasette like this:

BOT_TOKEN="this-is-the-secret-token" \
    datasette -m metadata.json

You can now run authenticated API queries like this:

$ curl -H 'Authorization: Bearer this-is-the-secret-token' \
  'http://127.0.0.1:8001/:memory:/show_version.json?_shape=array'
[{"sqlite_version()": "3.31.1"}]