nextlayer-sdk-python

Client utilities to interact with next layer public APIs.

Configuration

The module will use a YAML Config file to read it's configuration and also writes to it, to store obtained Tokens and their expiry (similar like kubctl does with kubeconfig).

Example ~/.nextlayer-sdk/auth.nlcustomers.yml:

server_url: https://login.nextlayer.at/auth/
realm_name: nlcustomers
client_id: nextlayer-sdk-python
username: foobar
password: topsecret

extra_params:
  audience: nextlayer-sdk-python

Except for username, all settings are optional, but if no password is supplied in config, the password will be asked interactively (if STDIN is a TTY) !

Alternatively the username can be suppled in the NEXTLAYERSDK_USERNAME environment variable or directly passed to the NlAuth constructor.

Alternatively the password can be suppliend in the NEXTLAYERSDK_PASSWORD environment variable.

For machine-to-machine authentication (no user account), a client_secret can be supplied instead of username/password - see Client Credentials Grant below.

Usage

import requests
from nextlayer.sdk.auth import NlAuth

nlauth = NlAuth()
access_token = nlauth.get_access_token()

# make Request to some API Endpoint
rsp = requests.get(
    "https://portal.nextlayer.at/apis/v1/users/self",
    headers={"Authorization": "Bearer " + access_token},
)
print(rsp.json())

You need to call the .get_access_token() Method every time you make API-Calls, because it checks if the Token is still valid and will refresh it if necessary.

Usage with httpx

import httpx

from nextlayer.sdk.auth_httpx import NlHttpxAuth

client = httpx.Client(
    timeout=httpx.Timeout(30.0),
    base_url=f"https://portal.nextlayer.at/apis/v1",
    auth=NlHttpxAuth(),
)
print(client.get("/users/self").json())

Client Credentials Grant (service accounts)

For machine-to-machine authentication without a user account, supply a client_secret instead of username/password:

nlauth = NlAuth(client_id="your_id", client_secret="topsecret")
access_token = nlauth.get_access_token()

The client_id/client_secret can also be set via the NEXTLAYERSDK_CLIENT_ID/ NEXTLAYERSDK_CLIENT_SECRET environment variables. Whenever a client_secret is present (non-empty), NlAuth auto-detects it and uses the OAuth2 client_credentials grant instead of the password grant - no username is needed or used. It is mutually exclusive with browser_login=True (passing both raises ValueError).

Note: client_secret is deliberately not exposed as a nextlayer-auth CLI flag - command-line arguments are visible to other local users via ps/process listings and get persisted in shell history. Use the environment variable, the config file, or the constructor param instead.

Usage fron commandline

The package also installs a commandline utility nextlayer-auth which takes care of obtaining an access token and printing out a proper Authorization: header.

curl -H "`nextlayer-auth`" https://portal.nextlayer.at/apis/v1/users/self

It can also be used to "logout" by cleaning up tokens in the yaml file with:

nextlayer-auth clear