Python API calls work in Jupyter Notebook, but fail when running as a Python script

Question

I have some code working great via a Notebook, but I want to move it to a server where I can run it as daemon. The authentication is failing when I run it on the server.

I suspect the problem is with the Scopes - User impersonation might work in the browser where I’m already logged in to the right project. What scope should I use instead when I’m calling directly from Python?

Also tried

myscope = '[f"https://westeurope-1.cognitedata.com/.default"]'

as suggested in the documentation

oauthlib.oauth2.rfc6749.errors.AccessDeniedError: (access_denied) Unauthorized

from cognite.client import CogniteClient, ClientConfig
from cognite.client.credentials import OAuthClientCredentials
from cognite.client.data_classes import TimeSeries

host = "https://westeurope-1.cognitedata.com"
myproject = "rok-buandcollaborators-53"
clientid = "realStuffWasHere"
secret = "secretsecretsecretsecretsecretsecret"
#myscope = "https://westeurope-1.cognitedata.com/.default"
myscope='["IDENTITY", "user_impersonation"]'
token="https://datamosaix-prod.us.auth0.com/oauth/token"
dataset = 8883655420989208 #chemdemo dataset

#creds = OAuthClientCredentials(token_url=token,client_id=clientid, client_secret=secret, scopes=myscope)
#cnf = ClientConfig(client_name="SJC_Raspi3b", base_url=host, project=myproject, credentials=creds)
creds = OAuthClientCredentials(
        token_url=token, # https://datamosaix-qa.us.auth0.com/oauth/token
        client_id=clientid,
        client_secret=secret,
        scopes=["IDENTITY", "user_impersonation"]
)

cnf = ClientConfig(
    client_name="SJC_Raspi3b",
    project=myproject,
    credentials=creds,
    base_url=host
)

cdf_client = CogniteClient(cnf)

ts_list = cdf_client.time_series.list() #debugging test for creds. not needed for real
print (ts_list)

icon

Best answer by Fredrik Holm 3 August 2023, 09:18

View original

Fredrik Holm · Accepted Answer

Hi Peter.Here’s a sample script that runs fine on my side, both in a notebook and as a deamonimport osfrom cognite.client import CogniteClient, ClientConfigfrom cognite.client.credentials import OAuthClientCredentialsscopes="user_impersonation"audience="https://cognitedata.com"projectName= "holminc-36"host= "https://westeurope-1.cognitedata.com"token_url="https://datamosaix-qa.us.auth0.com/oauth/token"client_id= os.environ["holm_inc_qa_ext_client_id"]client_secret= os.environ["holm_inc_qa_ext_client_secret"]oauth_provider = OAuthClientCredentials(    token_url=token_url,    client_id=client_id,    client_secret=client_secret,    scopes=scopes,    audience=audience)clientConfig = ClientConfig(    client_name="Non-prod testing",    project=projectName,    credentials=oauth_provider,    base_url=host,    debug=False)client = CogniteClient(clientConfig)print(client.raw.tables.list("Holm Inc db", limit=5))Please note that this is running in QA and that the scope assigned there are recently changed. The following scope should work in prod now, but needs to change as the scope change in QA is rolled out to prod.scopes="IDENTITY user_impersonation"

Håkon V. Treider · Answer

Starting with version6.6.1 of the SDK, some convenience methods were added to CogniteClientthat I suspect might give you an easier way to instantiate a client:from cognite.client import CogniteClientclient = CogniteClient.default_oauth_client_credentials(  project="rok-buandcollaborators-53",  cdf_cluster="westeurope-1",  tenant_id="0abcdef...",  client_id="d9b2bd26...",  client_secret="...",  client_name="Who am I?",)# For easy interactive login, check out:CogniteClient.default_oauth_interactive

Python API calls work in Jupyter Notebook, but fail when running as a Python script

4 replies

Reply

Reply

Sign up

Log in to the community

Scanning file for viruses.

This file cannot be downloaded