Skip to content

Clarifying readme for auth keys #288

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maxinelasp merged 2 commits into from
Dec 4, 2025
Merged

Clarifying readme for auth keys #288

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2587cd7
Clarifying readme
maxinelasp Dec 4, 2025
6212429
Move to one line
maxinelasp Dec 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 13 additions & 7 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,28 +132,34 @@ the environment variable ``IMAP_DATA_ACCESS_URL`` or within the
package ``imap_data_access.config["DATA_ACCESS_URL"]``. The default
is the production server ``https://api.imap-mission.com``.

### Automated use with API Keys
### Use with API Keys

The default for the CLI is to use the public endpoints.
To access some unreleased data products and quicklooks, you may
need elevated permissions. To programmatically get that, you need
need elevated permissions. To get that, you need
an API Key, which can be requested from the SDC team.

To use the API Key you can set the `IMAP_API_KEY` environment variable and then use
the tool as usual.
There are two ways to provide your API Key:

1. **Environment variable**: Set the `IMAP_API_KEY` environment variable

```bash
$ IMAP_API_KEY=<your-api-key>
$ export IMAP_API_KEY=<your-api-key>
Copy link
Contributor

@greglucas greglucas Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I still have a slight preference for doing this on the same line like we had it before instead of an export (which is also shell specific).
#286 (comment)

But, I agree this does need to change.

Copy link
Contributor Author

@maxinelasp maxinelasp Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it be enough to swap the lines, so the CLI flag is first? I'm not sure I understand what you mean about doing it on the same line... I can also remove this code block entirely since your point about the export is also valid.

If you think we should not set a key for an entire session, that's definitely valid, but that should be changed in the code rather than having it be undocumented behavior. I prefer to set a key for the entire session but I am very careful about it lol

Copy link
Contributor

@greglucas greglucas Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, what we had before was:

IMAP_API_KEY=<your-api-key> imap-data-access ...

Which only sets the API Key for that one command and not the entire session, so makes you think about exporting it rather than defaulting to the export. That is all I was trying to say to squash these two lines together. Not change any behavior.

Copy link
Contributor Author

@maxinelasp maxinelasp Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah fab, yeah I can change that!

$ imap-data-access ...
```

or with CLI flags
2. **Command line flag**: Use the `--api-key` flag

```bash
$ imap-data-access --api-key <your-api-key> ...
```

### Automated use with Access token
The command line flag will override the environment variable if both are set.

> [!NOTE]
> When using an API key, requests are automatically routed to `api.imap-mission.com/api-key` endpoints for authentication.

### Automated use with Access token (for software)

An alternative to using an API key to access protected data is using an access token provided by LASP's authentication server. LASP's authentication uses [keycloak authentication](https://www.keycloak.org/documentation).

Expand Down