Authentication mechanism for protected earthdata https links

[hrodmn]

I am not sure if this deserves any special treatment in obstore, but I'll file the issue anyways 😄

NASA makes all of its archived data publicly available via HTTPS links that require an EDL token to access. Here is a basic example of how to do this with obstore:

import os

import requests
from obstore.store import HTTPStore

def get_earthdata_token(username: str, password: str) -> str:
    r = requests.post(
       "https://urs.earthdata.nasa.gov/api/users/find_or_create_token",
       auth=(username, password),
    )
    r.raise_for_status()
    return r.json()["access_token"]

token = get_earthdata_token(
    os.getenv("EARTHDATA_USERNAME"),
    os.getenv("EARTHDATA_PASSWORD"),
)

url = "https://data.lpdaac.earthdatacloud.nasa.gov/lp-prod-protected"
store = HTTPStore(
    url,
    client_options={
       "default_headers": {
           "Authorization": f"Bearer {token}",
       }
    },
)

store.head("ECO_L2T_STARS.002/ECOv002_L2T_STARS_20FPJ_20180709_0712_01/ECOv002_L2T_STARS_20FPJ_20180709_0712_01_NDVI.tif")

{'path': 'ECO_L2T_STARS.002/ECOv002_L2T_STARS_20FPJ_20180709_0712_01/ECOv002_L2T_STARS_20FPJ_20180709_0712_01_NDVI.tif',
 'last_modified': datetime.datetime(2025, 2, 19, 7, 57, 25, tzinfo=datetime.timezone.utc),
 'size': 217222,
 'e_tag': '"3bb863cba40abe7bb8184e5033c32ca9-1"',
 'version': None}

This is not too much work but I wonder if it would be useful to create a NasaEarthdataHTTPCredentialProvider that could handle all of the token logic for the user provide the Auth: Bearer xxxx header to the HTTPStore when making requests. These tokens are really long-lived (60 days?) so token refreshes are not a concern.

Maybe this is not worth any code changes and a docs example would suffice!

[kylebarron]

I wouldn't recommend using an HTTPStore for this, because this isn't an actual WebDAV store; it's a HTTP backend with authentication. See #607. I think it would be better to use aiohttp directly, with an abstraction that implements relevant obspec protocols.

This is different from the existing NasaEarthdataCredentialProvider, because that uses an S3Store that provides actual object store semantics (even if at runtime some operations might not support your authentication, like delete/move/create)

So I don't think this should be added to obstore. I know we talked about a new earthdata-auth package that would possibly be able to abstract a bunch of this?