Credentials#
Most of the catalog is open: 42 of 48 products have at least one route that needs no account. The rest need one of the providers below.
Credentials are checked before the first network request, so a missing account raises CredentialError naming the provider, the setup steps and any credential-free alternative for that product — it never surfaces as a 403 halfway through a download.
import easysnowdata as esd
esd.auth.status() # which providers are configured, and how
esd.auth.login() # interactive setup for what is missing
esd.auth.login("earthengine", project="my-gcp-project")
provider |
required? |
environment variables |
files it reads |
products |
|---|---|---|---|---|
yes, for those products |
|
|
8 |
|
yes, for those products |
|
|
14 |
|
optional |
|
|
0 |
|
yes, for those products |
|
|
1 |
|
yes, for those products |
|
— |
1 |
|
yes, for those products |
|
— |
0 |
Nothing here is written to a configuration file of ours: every provider is set up the way that service documents, and read from the environment or from the file that service already uses (decision Q10).
NASA Earthdata#
NASA Earthdata Login setup (once):
import earthaccess
earthaccess.login(persist=True) # prompts; saves to ~/.netrc
or, in scripts and CI, set one of:
- EARTHDATA_USERNAME + EARTHDATA_PASSWORD (recommended for CI: earthaccess mints and
renews its own token from these, so nothing
expires)
- EARTHDATA_TOKEN (generate at urs.earthdata.nasa.gov; user tokens
expire after ~60 days, and an expired one is
ignored in favour of the credentials above
when they are also set)
A token alone does not reach NSIDC's on-premises archive (the RGI glacier
outlines): it answers with the login page. Those files are fetched with the
username and password (or the netrc), which may be set alongside a token.
Register for a free account at https://urs.earthdata.nasa.gov
Sign up: https://urs.earthdata.nasa.gov
Products with a route that needs it:
product |
route |
credential-free alternative |
|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
— none, this provider is the only way in |
|
|
— none, this provider is the only way in |
Earth Engine#
Google Earth Engine setup (once, in a terminal or notebook):
import ee
ee.Authenticate() # opens a browser; writes ~/.config/earthengine/credentials
earthengine set_project <project> # or set EE_PROJECT_ID; Earth Engine requires a Cloud project
In scripts and CI set EARTHENGINE_TOKEN to a service-account key JSON (raw or
base64), or point GOOGLE_APPLICATION_CREDENTIALS at one, and set EE_PROJECT_ID
when the key does not carry a project.
Sign up at https://earthengine.google.com
Sign up: https://earthengine.google.com
Products with a route that needs it:
product |
route |
credential-free alternative |
|---|---|---|
|
|
|
|
|
|
|
— none, this provider is the only way in |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
— none, this provider is the only way in |
|
|
|
|
|
|
|
|
|
|
|
|
Planetary Computer#
Optional
Everything works anonymously; credentials only raise the rate limits.
The Planetary Computer needs no account. To raise the anonymous rate limits,
set PC_SDK_SUBSCRIPTION_KEY (or write it to ~/.planetarycomputer/settings.env
with `planetarycomputer configure`).
Sign up: https://planetarycomputer.microsoft.com
No catalog product needs it today.
Planet#
Planet setup (needs a Planet account with data access, e.g. through the
Education & Research program):
pip install planet # or conda install -c conda-forge planet
planet auth login # OAuth2 in the browser; saves a session under ~/.planet/
or, in scripts and CI, set PL_API_KEY (legacy API key from
https://www.planet.com/account/) or PL_AUTH_CLIENT_ID + PL_AUTH_CLIENT_SECRET
(OAuth2 machine-to-machine client). Every order spends quota.
Sign up: https://www.planet.com/account/
Products with a route that needs it:
product |
route |
credential-free alternative |
|---|---|---|
|
— none, this provider is the only way in |
NVE HydAPI#
NVE HydAPI setup: request a free API key at https://hydapi.nve.no/UserDocumentation/
and set NVE_API_KEY.
Sign up: https://hydapi.nve.no/UserDocumentation/
Products with a route that needs it:
product |
route |
credential-free alternative |
|---|---|---|
|
— none, this provider is the only way in |
RIHMI АИСОРИ-М#
RIHMI АИСОРИ-М setup: register for a free account at
http://aisori-m.meteo.ru/waisori/registration.xhtml (no confirmation step),
then set AISORI_USERNAME and AISORI_PASSWORD.
Sign up: http://aisori-m.meteo.ru/waisori/registration.xhtml
No catalog product needs it today.
In CI#
The repository’s scheduled workflows read the same environment variables from GitHub secrets, which is why a credentialed gallery example or live test simply skips — rather than failing — when a secret is absent:
secret |
used by |
|---|---|
|
live tests, health probes, scheduled docs build |
|
live tests, health probes, scheduled docs build |
|
Planet live tests and the PlanetScope gallery example |
|
the NVE station live test and gallery example |
|
the RIHMI АИСОРИ-М live test and gallery example |
Pull-request builds get none of them, by design: they run the offline test tiers and the credential-free subset of the gallery.
Earthdata user tokens expire after about 60 days, which is how a green pipeline turns red for no reason of its own. The workflows therefore hold the username and password: earthaccess mints and renews a token from them on every run, and if an EARTHDATA_TOKEN secret is also set and Earthdata Login rejects it, the provider logs a warning and falls back to the username and password rather than failing.