Credentials

Most of the catalog is open: 22 of 28 products have at least one route that needs no account. The rest need one of the providers below.

Credentials are checked before the first network request, so a missing account raises CredentialError naming the provider, the setup steps and any credential-free alternative for that product — it never surfaces as a 403 halfway through a download.

import easysnowdata as esd

esd.auth.status()          # which providers are configured, and how
esd.auth.login()           # interactive setup for what is missing
esd.auth.login("earthengine", project="my-gcp-project")

provider	required?	environment variables	files it reads	products
NASA Earthdata	yes, for those products	EARTHDATA_TOKEN, EARTHDATA_USERNAME, EARTHDATA_PASSWORD	~/.netrc	7
Earth Engine	yes, for those products	EARTHENGINE_TOKEN, GOOGLE_APPLICATION_CREDENTIALS, EE_PROJECT_ID, EARTHENGINE_PROJECT	~/.config/earthengine/credentials	9
Planetary Computer	optional	PC_SDK_SUBSCRIPTION_KEY	~/.planetarycomputer/settings.env	0
Planet	yes, for those products	PL_API_KEY, PL_AUTH_API_KEY, PL_AUTH_CLIENT_ID, PL_AUTH_CLIENT_SECRET, PL_AUTH_PROFILE	~/.planet.json, ~/.planet/	1
NVE HydAPI	yes, for those products	NVE_API_KEY	—	1

Nothing here is written to a configuration file of ours: every provider is set up the way that service documents, and read from the environment or from the file that service already uses (decision Q10).

NASA Earthdata

NASA Earthdata Login setup (once):

    import earthaccess
    earthaccess.login(persist=True)   # prompts; saves to ~/.netrc

or, in scripts and CI, set one of:
  - EARTHDATA_TOKEN                        (recommended; generate at urs.earthdata.nasa.gov,
                                            user tokens expire after ~60 days)
  - EARTHDATA_USERNAME + EARTHDATA_PASSWORD

Register for a free account at https://urs.earthdata.nasa.gov

Sign up: https://urs.earthdata.nasa.gov

Products with a route that needs it:

product	route	credential-free alternative
Harmonized Landsat Sentinel-2 (HLS) v2.0	lpcloud-cmr-stac	planetary-computer
MODIS snow cover (MOD10A1, MOD10A2, MOD10A1F)	nsidc	planetary-computer
Sentinel-1 local incidence angle and layover/shadow mask	opera-static	dem
Sentinel-1 radiometrically terrain-corrected backscatter	opera-rtc-s1	planetary-computer
Sturm & Liston seasonal snow classification	nsidc	hosted-cog
UCLA snow reanalysis (Western US and High Mountain Asia)	nsidc, nsidc-hma	— none, this provider is the only way in
VIIRS snow cover (VNP10A1, VNP10A1F)	nsidc	— none, this provider is the only way in

Earth Engine

Google Earth Engine setup (once, in a terminal or notebook):

    import ee
    ee.Authenticate()                    # opens a browser; writes ~/.config/earthengine/credentials
    earthengine set_project <project>    # or set EE_PROJECT_ID; Earth Engine requires a Cloud project

In scripts and CI set EARTHENGINE_TOKEN to a service-account key JSON (raw or
base64), or point GOOGLE_APPLICATION_CREDENTIALS at one, and set EE_PROJECT_ID
when the key does not carry a project.

Sign up at https://earthengine.google.com

Sign up: https://earthengine.google.com

Products with a route that needs it:

product	route	credential-free alternative
CHILI (Continuous Heat-Insolation Load Index)	gee	— none, this provider is the only way in
ERA5 / ERA5-Land reanalysis	gee	arco-era5-gcs
Forest cover fraction (CGLS-LC100)	gee	zenodo
USGS Watershed Boundary Dataset (HUC)	gee	usgs-wbd
HydroBASINS / BasinATLAS	gee	figshare-basinatlas, hydrosheds
National Land Cover Database (NLCD)	gee-annual, gee	— none, this provider is the only way in
Sentinel-1 local incidence angle and layover/shadow mask	gee	dem
Sentinel-1 radiometrically terrain-corrected backscatter	gee	planetary-computer
SNODAS snow water equivalent and snow depth	gee-climate-engine	nsidc

Planetary Computer

Optional

Everything works anonymously; credentials only raise the rate limits.

The Planetary Computer needs no account. To raise the anonymous rate limits,
set PC_SDK_SUBSCRIPTION_KEY (or write it to ~/.planetarycomputer/settings.env
with `planetarycomputer configure`).

Sign up: https://planetarycomputer.microsoft.com

No catalog product needs it today.

Planet

Planet setup (needs a Planet account with data access, e.g. through the
Education & Research program):

    pip install planet          # or conda install -c conda-forge planet
    planet auth login           # OAuth2 in the browser; saves a session under ~/.planet/

or, in scripts and CI, set PL_API_KEY (legacy API key from
https://www.planet.com/account/) or PL_AUTH_CLIENT_ID + PL_AUTH_CLIENT_SECRET
(OAuth2 machine-to-machine client). Every order spends quota.

Sign up: https://www.planet.com/account/

Products with a route that needs it:

product	route	credential-free alternative
PlanetScope surface reflectance (Planet Labs)	orders-api, data-api	— none, this provider is the only way in

NVE HydAPI

NVE HydAPI setup: request a free API key at https://hydapi.nve.no/UserDocumentation/
and set NVE_API_KEY.

Sign up: https://hydapi.nve.no/UserDocumentation/

Products with a route that needs it:

product	route	credential-free alternative
Norwegian snow pillows and snow-depth stations (NVE HydAPI)	nve	— none, this provider is the only way in

In CI

The repository’s scheduled workflows read the same environment variables from GitHub secrets, which is why a credentialed gallery example or live test simply skips — rather than failing — when a secret is absent:

secret	used by
EARTHDATA_TOKEN (or EARTHDATA_USERNAME + EARTHDATA_PASSWORD)	live tests, health probes, scheduled docs build
EARTHENGINE_TOKEN	live tests, health probes, scheduled docs build
PL_API_KEY	Planet live tests and the PlanetScope gallery example
NVE_API_KEY	the NVE station live test and gallery example

Pull-request builds get none of them, by design: they run the offline test tiers and the credential-free subset of the gallery.