DestinE Auth is a helper package that simplifies authentication for DestinE workflows:
- Authenticate with DESP credentials.
- Get a DESP access token. (Normally transparent for the user)
- Exchange that token for a DEDL access token.
A Destination Earth - Data Lake access token is necessary to interact with Destination Earth - Data Lake APIs and services.
pip install destinelabNote: Python compatibility: 3.8+
- Here's a quick example of how to use the
AuthHandlerto get a DEDL token using DESP credentials. This is the recommended approach for most users, as it handles caching and token refresh automatically.
from destinelab import AuthHandler
handler = AuthHandler("DESP_USERNAME", "DESP_PASSWORD")
dedl_token = handler.get_token()
auth_headers = {"Authorization": f"Bearer {dedl_token}"} # Example of how to use the token in API requestsBy default, the package is quiet and does not configure global logging. To enable debug output for troubleshooting, configure the package logger explicitly:
import logging
from destinelab import configure_logging
configure_logging(level=logging.DEBUG)You can set INFO, WARNING, ERROR, or DEBUG depending on how much detail you need.
from destinelab import DEDLServiceAccountAuth
dedl_token = DEDLServiceAccountAuth(
client_id="YOUR_CLIENT_ID",
client_secret="YOUR_CLIENT_SECRET",
).get_token()AuthHandleralso provides helper methods to check the roles associated with the token and whether DT access is allowed, which can be useful for debugging or conditional logic in your application.
from destinelab import AuthHandler
handler = AuthHandler("DESP_USERNAME", "DESP_PASSWORD")
dedl_token = handler.get_token()
roles = handler.get_roles(dedl_token)
is_dt_access_allowed = handler.is_DTaccess_allowed(dedl_token)- This is not recommended or useful for typical users, but can be useful for debugging or if you need more control over the individual steps.
from destinelab import DESPAuth, DEDLAuth
desp_token = DESPAuth("DESP_USERNAME", "DESP_PASSWORD").get_desp_token()
dedl_token = DEDLAuth(desp_token).get_token()DESPAuth.get_desp_token()raises explicit auth errors (for example invalid credentials, OTP required, network failures, and DESP token exchange failures).DEDLAuth.get_token()raises explicit exceptions on exchange failure.DEDLServiceAccountAuth.get_token()raises explicit exceptions on service-account authentication failure.AuthHandler.get_token()first checks whether an already stored DEDL token is still valid (verified against DEDL Keycloak JWKS). If valid, it is returned immediately; otherwise it composesDESPAuth -> DEDLAuthusing DESP user credentials.- If cached-token validation cannot be completed because the validator backend is unavailable (for example metadata/JWKS lookup issues),
AuthHandler.get_token()logs a warning and continues with a refresh flow (DESPAuth -> DEDLAuth).
This project is licensed under MIT. See LICENSE.
MIT License
Copyright (c) 2025 Patryk Grzybowski
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.