Context
EDITO relies on several different tokens and credentials depending on what you're trying to do: calling an API, accessing your storage, or managing secrets. These are three separate systems, each with its own token, its own way to obtain it, and its own expiry rules. Mixing them up is one of the most common sources of authentication errors.
This article gives you an overview of each one and points you to the dedicated article for the full details. If you're getting an authentication error and aren't sure which token is involved, start here.
⚠️ None of these tokens should ever be committed to a public repository or shared outside your team. If you suspect a token has been exposed, regenerate it immediately.
Overview
📌 Note: these three systems are independent. A token from one won't work with another, and refreshing one does not refresh the others.
API access token (Data API, Process API, Service API)
📌 Note: session tokens are valid for 24 hours.
What it's for: authenticating requests to EDITO's APIs (creating catalogue items, launching a process programmatically, managing a service, etc.). Used as a Bearer token in the Authorization header.
How to get it: Keycloak is the identity and login system EDITO uses behind the scenes, it's what handles your sign-in whenever you log in to the Datalab. Getting an API access token means asking Keycloak to issue you one, either through your active Datalab login session or with the refreshEditoApiAccessToken.sh script from inside a running service.
💡 See Get tokens and access tokens for the full procedure, including how to get a long-lived "offline" token for automated scripts.
📌 Note: requests to Keycloak require a client_id field. Which value to use depends on the service you're targeting, but this isn't detailed anywhere yet. If you're unsure which client_id to use for the API you're calling, contact support.
S3 credentials (personal or project storage)
📌 Note: MinIO tokens are valid for 24 hours.
What it's for: reading or writing data on your EDITO storage (MinIO) or a project's CloudFerro bucket, from the command line or a script, whether from inside a running service or from an external machine.
How to get it: from inside a running EDITO service, credentials (access key, secret key, and session token) are injected automatically as environment variables, nothing to configure. From outside EDITO, you refresh them yourself (see Renew temporary credentials and Transfer data between your computer/cluster and EDITO).
⚠️ These credentials always come as a triplet: access key, secret key, and session token. All three must be used together and come from the same generation. Reusing a session token with a different access key (or vice versa) will fail with an InvalidTokenId error. Session tokens expire after 24 hours.
Vault token (secrets)
📌 Note: Vault tokens are valid for 1 month.
What it's for: reading, creating, or deleting secrets you've stored in My Secrets (API keys, passwords, or any other value you don't want hardcoded in your code), via the hvac Python client or the Vault CLI.
How to get it: from inside a running service or process, use the official Vault CLI, either following the official Vault documentation or the code snippet shown at My Account > Vault > Use vault from your terminal.
📌 Note: for more details and the exact <YOUR_VAULT_TOKEN> value used in Python (hvac) examples, see Secret Management.
Git tokens for private repositories
If you're connecting a private Git repository (GitHub, GitLab, etc.) to a service or process, you'll also need a personal access token, generated from your Git provider's own settings (not from EDITO), then entered in the service or process configuration's authentication settings. See Add your own service on EDITO.
📌 Note: this isn't an EDITO-managed token system like the three above, it's a credential from your Git provider that EDITO simply stores and uses to authenticate the pull. It doesn't generate or refresh it for you.
Which token do I need?
💡 EDITO Pro Tip: if you're not sure which token an error message is about, check what you were doing when it happened.
Calling
api.dive.edito.eu(Data, Process, or Service API) → API access tokenUsing
mc,boto3,s3fs, or any S3-compatible tool → S3 credentialsUsing
hvac, the Vault CLI, or reading a secret → Vault tokenConfiguring a service or process to pull from a private repo → Git personal access token
What's next?
If you have any questions, problems, or suggestions, please feel free to contact us via chat using the widget available at the bottom right of the page.