[HELP] SentinelHub authentication no longer working

[JackLidge]

Hi there,

I'm using a (probably now outdated) workflow to access and download Sentinel-2 L1C data in .SAFE format from AWS using SentinelHub. As of the last week or two I'm getting UnauthorizedClientErrors when trying to download the data, which is probably due to the recent updates made to the config settings.

For reference, I have all the credentials in a config file in the following format:

shub:
    instance_id: *instance_id*
    sh_client_id: *client_id*
    sh_client_secret: *client_secret*
    aws_access_key_id: *aws_key*
    aws_secret_access_key: *aws_secret*

and I then load the credentials in the following way inside my script:

    config = sentinelhub.SHConfig()
    config.instance_id = cred['shub']['instance_id']
    config.sh_client_id = cred['shub']['sh_client_id']
    config.sh_client_secret = cred['shub']['sh_client_secret']
    config.aws_access_key_id = cred['shub']['aws_access_key_id']
    config.aws_secret_access_key = cred['shub']['aws_secret_access_key']
    config.save()

I then create a search_iterator in the following way:

    bbox = [lon-0.1, lat-0.1, lon+0.1, lat+0.1]
    aoi_bbox = sentinelhub.BBox(bbox=bbox, crs=sentinelhub.CRS.WGS84)

    start_date = datetime.datetime.strptime(dataframe['start_date'], '%Y-%m-%d')
    end_date = datetime.datetime.strptime(dataframe['end_date'], '%Y-%m-%d')
    interval = (datetime.datetime.strftime(start_date, '%Y-%m-%dT%H:%M:%S'), 
                datetime.datetime.strftime(end_date, '%Y-%m-%dT%H:%M:%S'))

    catalog = sentinelhub.SentinelHubCatalog()

    # Find S2 tile in AWS S3 Bucket
    search_iterator = catalog.search(
        sentinelhub.DataCollection.SENTINEL2_L1C,
        bbox=aoi_bbox,
        time=interval,
        filter=f'eo:cloud_cover <= {cfg["sentinel2"]["cloud_cov"]}'
    )

    tiles = list(search_iterator)

And in the last line, I am getting the following error (can provide full traceback if needed):

oauthlib.oauth2.rfc6749.errors.UnauthorizedClientError: (unauthorized_client) Invalid client or Invalid client credentials

which I assume is due to not setting up a token in the correct way as I have now seen in the documentation. If I change to generate a token on each download, will that solve this issue?

I originally set up this workflow over a year ago and due to our use requirements, we currently need to download L1C data in .SAFE format. However, I have seen that downloading in .SAFE format from SentinelHub's AWS Bucket is deprecated now, what is the most effective way to achieve this currently? In the new year I will investigate to see if we can switch to using L2A data and therefore switching to STAC to access the data but for the time being I think this method will need to continue to be used.

Any help with this very appreciated.

[zigaLuksic]

Hi @JackLidge which version are you using?

In the past few weeks there were some changes to authentication, so it could be that you are missing some updates.

We are also no longer actively supporting direct AWS downloads. There are currently no plans of removing the code in the near future, but i can give no guarantees for how long it will work/remain in the package..

As a side-note, in the new versions you might get by with sentinelhub.SHConfig(**creds['shub']).save()

[JackLidge]

Hi @zigaLuksic, thanks for the speedy reply!

I'm using v3.8.0 at the moment which I see is a bit out of date. I will try updating to the newest version and using the code snippet you recommend. Will let you know how I get on!

[JackLidge]

Yep that fixed it, thanks for the help!