Authentication API

curl -H "Authorization: Bearer PERSONAL_ACCESS_TOKEN" -X GET https://api.optimizely.com/v2/export/credentials\?duration\=1h

{
 "credentials": {
   "accessKeyId": "ACCESS_KEY_ID",
   "secretAccessKey": "SECRET_ACCESS_KEY",
   "sessionToken": "SESSION_TOKEN",
   "expiration": 1591026407394
 },
 "s3Path": "s3://optimizely-events-data/v1/account_id=123"
}

export AWS_ACCESS_KEY_ID=ACCESS_KEY_ID
export AWS_SECRET_ACCESS_KEY=SECRET_ACCESS_KEY
export AWS_SESSION_TOKEN=SESSION_TOKEN

aws s3 ls s3://optimizely-events-data/v1/account_id=ACCOUNT_ID/type=decisions/date=YYYY-MM-DD/

curl -H "Authorization: Bearer PERSONAL_ACCESS_TOKEN" -X GET https://api.optimizely.com/v2/export/credentials/gcp

{
  "token": "gcp_access_token",
  "uri": "gs://optimizely-e3-123"
}

export CLOUDSDK_AUTH_ACCESS_TOKEN=TOKEN

gcloud storage ls gs://optimizely-e3-ACCOUNT_ID/v1/account_id=ACCOUNT_ID/type=decisions/date=YYYY-MM-DD/

gcloud storage cp -r gs://optimizely-e3-ACCOUNT_ID/v1/account_id=ACCOUNT_ID/type=decisions/date=YYYY-MM-DD/ .

#!/usr/bin/env python3

from botocore.credentials import RefreshableCredentials
from botocore.session import get_session
from datetime import datetime
import requests as r
import boto3
import pytz
import sys


class BearerAuth(r.auth.AuthBase):
    """
    Bearer authentication class that integrates with requests'
    native authentication mechanism.
    """

    def __init__(self, token):
        """
        Args:
            token (str): Bearer token used to authenticate requests to an API
        """
        self.token = token

    def __call__(self, request):
        """Sets the Authorization header on the current HTTP request.
        Args:
            request (request): The current HTTP request object.
        Returns:
            request: The current HTTP request with additional
                     Authorization header
        """
        request.headers['Authorization'] = f"Bearer {self.token}"
        return request


class OptimizelyS3Client(object):
    """
    AWS S3 client using credentials from Optimizely
    """

    EXPORT_CREDENTIALS_URL = 'https://api.optimizely.com/v2/export/credentials'
    CREDENTIALS_IDENTIFIER = 'Optimizely'
    EVENT_EXPORT_BUCKET_REGION = 'us-east-1'

    def __init__(self, token: str):
        """
        Args:
            token (str): Optimizely personal access token
        """
        self.token = token

    def get_bucket_prefix(self, account_id: str) -> str:
        """Get the bucket prefix for a given Optimizely account ID
        Args:
            account_id (str): Optimizely account ID
        Returns:
            str: The S3 bucket prefix to access events data
        """
        return f"v1/account_id={account_id}/"

    def get_creds(self) -> dict:
        """Get AWS credentials from the Optimizely public API
        Returns:
            dict: The AWS credentials for a given Optimizely account
        """
        response = r.get(
            OptimizelyS3Client.EXPORT_CREDENTIALS_URL,
            auth=BearerAuth(self.token)
        )

        node = response.json()
        return node['credentials']

    def as_boto3_s3_client(self):
        """
        Convert the Optimizely S3 client to a standard boto s3
        client with refreshable credentials
        Returns:
            botocore.client.S3: Standard boto3 S3 client
        """
        creds = self.get_creds()

        # The API response is in milliseconds
        expiry_time = int(creds['expiration'] / 1000)

        # boto expects the expiry time to be a UTC datetime
        expiry_time = datetime.fromtimestamp(expiry_time, pytz.utc)

        opz_refreshable_credentials = RefreshableCredentials(
            creds['accessKeyId'],
            creds['secretAccessKey'],
            creds['sessionToken'],
            expiry_time,
            self.get_creds,
            OptimizelyS3Client.CREDENTIALS_IDENTIFIER
        )

        session = get_session()
        session._credentials = opz_refreshable_credentials
        session.set_config_variable('region', OptimizelyS3Client.EVENT_EXPORT_BUCKET_REGION)
        opz_session = boto3.Session(botocore_session=session)
        s3_client = opz_session.client('s3')

        return s3_client


def main():
    EVENT_EXPORT_BUCKET_NAME = 'optimizely-events-data'
    OPTIMIZELY_ACCOUNT_ID = 'YOUR_ACCOUNT_ID'
    OPTIMIZELY_PERSONAL_ACCESS_TOKEN = 'YOUR_PERSONAL_ACCESS_TOKEN'

    optimizely_s3_client = OptimizelyS3Client(OPTIMIZELY_PERSONAL_ACCESS_TOKEN)
    s3_client = optimizely_s3_client.as_boto3_s3_client()

    all_objects = s3_client.list_objects(
        Bucket=EVENT_EXPORT_BUCKET_NAME,
        Prefix=optimizely_s3_client.get_bucket_prefix(OPTIMIZELY_ACCOUNT_ID)
    )
    print(all_objects)


if __name__ == '__main__':
    main()

#!/usr/bin/env python3

import requests
from google.cloud import storage
from google.oauth2.credentials import Credentials

EXPORT_CREDENTIALS_GCP_URL = "https://api.optimizely.com/v2/export/credentials/gcp"

# Your Optimizely account ID and Personal Access Token.
OPTIMIZELY_ACCOUNT_ID = "YOUR_ACCOUNT_ID"
OPTIMIZELY_PERSONAL_ACCESS_TOKEN = "YOUR_PERSONAL_ACCESS_TOKEN"


def get_gcp_token(pat: str) -> str:
    """Exchange an Optimizely personal access token for a temporary GCP token.

    The returned token grants read-only access and expires after one hour.
    Call this function again to get a fresh token.
    """
    response = requests.get(
        EXPORT_CREDENTIALS_GCP_URL,
        headers={"Authorization": f"Bearer {pat}"},
    )
    response.raise_for_status()
    return response.json()["token"]


def main():
    token = get_gcp_token(OPTIMIZELY_PERSONAL_ACCESS_TOKEN)
    credentials = Credentials(token=token)

    # The client uses your own GCP project for billing and quota.
    client = storage.Client(project="YOUR_GCP_PROJECT", credentials=credentials)
    bucket = client.bucket(f"optimizely-e3-{OPTIMIZELY_ACCOUNT_ID}")

    prefix = f"v1/account_id={OPTIMIZELY_ACCOUNT_ID}/type=decisions/"
    for blob in bucket.list_blobs(prefix=prefix):
        print(blob.name)


if __name__ == "__main__":
    main()