Science Platform Tokens

The Notebook Aspect of the Rubin Observatory Science Platform provides access tokens for interacting with other services provided by the Science Platform. An example is the TAP service provided by the API Aspect. When interacting with authenticated services for within the Notebook Aspect you typically doesn’t need to interact with the access tokens since the various clients are able to pick up the token from your user environment. This access token can also be used outside the Notebook Aspect to access services from a local machine (for example, to access the TAP service from TOPCAT).

This page will give you an introduction to the access token, where to find it, how to inspect it, and how to use it in an environment outside the Notebook Aspect. Note that the access token has a finite lifetime and is refreshed on each login to the Notebook Aspect.

The access token

The access token is mounted in a known location in your home space. To view it, you can simply look a the special file called ~/.access_token. From within a terminal execute the following command.

cat ~/.access_token

The environment includes a notebook, at ~/notebooks/notebook-demo/token-info.ipynb, that allows you to inspect a token. Executing the two cells in the notebook will provide information about token creation time and lifetime among other things. You will note from the above notebook that the token is also provided as the value of the environment variable ACCESS_TOKEN, but the file version should be considered primary.

Using a token outside the Science Platform

Following is a recipe for an example workflow that uses the access token taken from a JupyterLab session to access the Science Platform TAP service from a local computer using TOPCAT. You can apply similar steps to other use cases.

  1. Open a terminal.

  2. As in the last section, use the cat command to print out your access token. It should be quite a long string.

    $ cat ~/.access_token
eyJ0eXAiOiJKV1QiLCJhbGci...

  3. Copy the entire token string to your clipboard.

  4. On your local machine open up TOPCAT. This will require having Java installed.

  5. Once you have TOPCAT open, you will see a menu item called “VO”. From that dropdown, select the entry that says “Table Access Protocol (TAP) Query”.

The VO menue

  1. This will bring up a window with a list of available TAP services. We want to use a service with a known endpoint. Enter https://lsst-lsp-stable.ncsa.illinois.edu/api/tap in the box at the bottom of the page labeled “TAP URL”.

    The TAP service configuration window.

  2. Clicking “Use Service” will bring up a username/password dialog. Paste the entire access token into the User field. Leave the password field blank.

    Username and password dialog.

  3. If authentication is successful, the window will change to the TAP service window and information about the various tables in the service will appear in the left portion of the upper panes. If you select a table, you will see information about the columns in the table to the right of the table listing.

    For this example, I used the wise_00.allwise_p3as_mep table which provides photometry among other things. Make a query by entering the ADQL in the box at the bottom and click the “Run Query” button.

    The example query selects three magnitudes from a circular region on the sky.

    SELECT w1mpro_ep, w2mpro_ep, w3mpro_ep FROM wise_00.allwise_p3as_mep WHERE CONTAINS(POINT('ICRS', ra, decl), CIRCLE('ICRS', 192.85, 27.13, .2)) = 1
    Query window

  4. Once the query returns, you can make plots like this color-color diagram. I made two more synthetic columns from the magnitude columns to plot.

    A color color plot from wise data.