destinepyauth 0.2.0

Harmonized Python script for DestinE authentication.

destinepyauth

A Python library for authenticating against DESP (Destination Earth Service Platform) services.

Installation

pip install destinepyauth

For development:

pip install -e ".[dev]"

Usage

The main entry point is the get_token() function:

from destinepyauth import get_token

# Authenticate (prompts for credentials if not in environment)
result = get_token("highway")

# Access the token
token = result.access_token

Using with requests

from destinepyauth import get_token
import requests

result = get_token("eden")
headers = {"Authorization": f"Bearer {result.access_token}"}
response = requests.get("https://api.example.com/data", headers=headers)

Using with zarr/xarray (netrc support)

For services like CacheB that work with zarr, you can write credentials to ~/.netrc:

from destinepyauth import get_token
import xarray as xr

# Authenticate and write to ~/.netrc
get_token("cacheb", write_netrc=True)

# Now zarr/xarray will use credentials automatically
ds = xr.open_dataset(
    "reference://",
    engine="zarr",
    backend_kwargs={
        "consolidated": False,
        "storage_options": {
            "fo": "https://cacheb.dcms.destine.eu/path/to/data.json",
            "remote_protocol": "https",
            "remote_options": {"client_kwargs": {"trust_env": True}},
        },
    },
)

Available Services

• cacheb - CacheB data service
• dea - DEA service
• eden - Eden broker
• highway - Highway service (includes token exchange)
• insula - Insula service
• streamer - Streaming service

Credential Handling

When you call get_token(), the library will prompt for your credentials with masked input for both username and password - nothing you type will be visible on screen:

from destinepyauth import get_token
result = get_token("highway")
# Username:   (hidden input)
# Password:   (hidden input)

This ensures credentials cannot be accidentally exposed in terminal logs, screen recordings, or shell history.