Context

EDITO services use authentication behind the scenes. When you launch a service through the platform, the service runs inside a secure container. This container needs a valid token to call protected EDITO endpoints. This token is not hard-coded inside the container. You are responsible for retrieving it—either manually or automatically—when your service starts.

📌 Note: some endpoints require that the user is logged in into EDITO.

Get a token directly from a service

To retrieve your token inside a service with a terminal, simply run source /opt/refreshEditoApiAccessToken.sh. It will prompt for your username and password and export your token in environment variable EDITO_ACCESS_TOKEN. If you set the EDITO_USERNAME and EDITO_PASSWORD environment variables, it will directly return the token without any prompt.

💡 EDITO Pro Tip: refreshEditoApiAccessToken.sh is directly available only through EDITO's built-in tools. You can find the code here if necessary:

#!/usr/bin/env bash

# Prompt for EDITO username and password if not set
if [ -z "$EDITO_USERNAME" ]; then
    read -p "Username: " -i ${KUBERNETES_NAMESPACE#"user-"} -e EDITO_USERNAME
fi
if [ -z "$EDITO_PASSWORD" ]; then
    read -s -p "Password: " -e EDITO_PASSWORD
fi
echo

# Ask token to keycloak
curlKeycloakCommand="curl --silent -X POST 'https://auth.dive.edito.eu/auth/realms/datalab/protocol/openid-connect/token' -H 'Content-Type: application/x-www-form-urlencoded' -d 'client_id=edito' -d 'username=${EDITO_USERNAME}' --data-urlencode 'password=${EDITO_PASSWORD}' -d 'grant_type=password' -d 'scope=openid'"
curlKeycloakResult=$(eval $curlKeycloakCommand)
keycloakToken=$(echo "$curlKeycloakResult" | tr ',' '\n' | grep -o '"access_token":"[^"]*' | sed 's/"access_token":"//')

unset EDITO_USERNAME
unset EDITO_PASSWORD

export EDITO_ACCESS_TOKEN=$keycloakToken
echo "export EDITO_ACCESS_TOKEN=$EDITO_ACCESS_TOKEN"

Get a token programmatically

Alternatively, if you want to programmatically retrieve a token, here is the logic given as a curl command that you need to apply.

📌 Note: you may want to adapt it to the language you are using.

Depending on the service you are targeting, you will need to set the client_id field accordingly.

curl -d 'client_id=<CLIENT_ID>' -d 'username=<USERNAME>' --data-urlencode 'password=<PASSWORD>' -d 'grant_type=password' 'https://auth.dive.edito.eu/auth/realms/datalab/protocol/openid-connect/token' -d 'scope=openid'

Where you have to replace <USERNAME> and <PASSWORD> by your EDITO username and password respectively.

You should receive both an access_token and a refresh_token. The access_token will expire after the value (in seconds) behind the key expires_in. After that, you will no longer be able to use it. So you’ll have to use your refresh_token to ask a new one.

📌 Note: renewing the token means that the current one will be extended.

Those tokens are JWT (JSON Web Token). You can decode them using https://jwt.io/ if you want read their content. Or you can also use some well known libraries to do the same programmatically.

Again, here is the curl command to do that:

curl -X POST \
  'https://auth.dive.edito.eu/auth/realms/datalab/protocol/openid-connect/token' \
  -d 'client_id=<CLIENT_ID>' \
  -d 'grant_type=refresh_token' \
  -d 'refresh_token=<YOUR_REFRESH_TOKEN>'

This will return you a new access_token along with a new refresh_token.

Get an offline token

If you need long-lived access (e.g. for automation or background tasks), you can request an offline token by adding the offline_access scope.

📌 Note: you may want to adapt it to the language you are using.

Again depending on the service you are targeting, you will need to set the client_id field accordingly.

curl -d 'client_id=<CLIENT_ID>' \
     -d 'username=<USERNAME>' \
     --data-urlencode 'password=<PASSWORD>' \
     -d 'grant_type=password' \
     -d 'scope=openid offline_access' \
     'https://auth.dive.edito.eu/auth/realms/datalab/protocol/openid-connect/token'| jq -r '.refresh_token'

You have to replace <USERNAME> and <PASSWORD> by your EDITO username and password respectively.

You will receive:

an access_token
a refresh_token → this is your offline token

The offline token can be stored and reused to generate new access tokens without requiring the user to log in again.

To obtain a new access token from an offline token:

Again, here is the curl command to do that:

curl -X POST \
  'https://auth.dive.edito.eu/auth/realms/datalab/protocol/openid-connect/token' \
  -d 'client_id=<CLIENT_ID>' \
  -d 'grant_type=refresh_token' \
  -d 'refresh_token=<YOUR_REFRESH_TOKEN>'

This will return you a new access_token along with a new refresh_token.

This is useful for:

automation scripts
batch jobs
system operations

FAQ

When a suspended service starts again, will a fresh vault token be passed?

No, it stays the same as long as it's valid.

The password for my S3 bucket is stored in Vault. If a service runs fo more than a month, it will no longer be able to access Vault because the token has expired. How can I rotate the S3 password without having to restart the service?

The best approach is to use a function or API endpoint within the service to programmatically update the token vault with the EDITO token. Then request a new token:

### Python ###

import requests
import json

url = "https://vault.dive.edito.eu/v1/auth/jwt/login"

payload = json.dumps({
"role": "secret-user",
"jwt": "EDITO_TOKEN_VALUE"
})
headers = {
'Content-Type': 'application/json'
}

response = requests.request("POST", url, headers=headers, data=payload)

data = response.json()
new_vault_token = data["auth"]["client_token"]

print(new_vault_token)

What's next?

If you have any questions, problems, or suggestions, please feel free to contact us via chat using the widget available at the bottom right of the page.

Get tokens and access tokens