Tenant Token Management¶

Tenant tokens are service credentials that allow programmatic access to Elevate on behalf of a tenant. Each token is bound to one or more roles that define its permissions, and has a configurable expiration.

This notebook demonstrates how to:

• Create a tenant token with a description, roles, and expiration
• Inspect the returned token (the secret is only returned once — store it immediately)
• Delete the token when it is no longer needed

Install the SDK¶

In [ ]:

skip-execution

!pip install --upgrade earnix-elevate

!pip install --upgrade earnix-elevate

Set your Elevate server and credentials¶

Prerequisite: A user with the Token Admin role must first log in to the Elevate UI (MFA required) and create a tenant token from the UI. The resulting client_id and secret_key are then used as credentials below.

In this example we use environment variables to authenticate to Elevate, but you can also inject your credentials using Python arguments to each Service's client, like in the commented example.

In [ ]:

## Set your Elevate server and credentials
import os

os.environ.setdefault("E2_SERVER", "YOUR_SERVER")
os.environ.setdefault("E2_CLIENT_ID", "YOUR_CLIENT_ID")
os.environ.setdefault("E2_SECRET_KEY", "YOUR_SECRET_KEY")

# Alternatively:
# IdentityService(
#     server="YOUR_SERVER",
#     client_id="YOUR_CLIENT_ID",
#     secret_key="YOUR_SECRET_KEY"
# )

## Set your Elevate server and credentials import os os.environ.setdefault("E2_SERVER", "YOUR_SERVER") os.environ.setdefault("E2_CLIENT_ID", "YOUR_CLIENT_ID") os.environ.setdefault("E2_SECRET_KEY", "YOUR_SECRET_KEY") # Alternatively: # IdentityService( # server="YOUR_SERVER", # client_id="YOUR_CLIENT_ID", # secret_key="YOUR_SECRET_KEY" # )

Imports¶

In [ ]:

from earnix_elevate import (
    CreateTenantTokenRequest,
    IdentityService,
)

from earnix_elevate import ( CreateTenantTokenRequest, IdentityService, )

Create a Tenant Token¶

To create a tenant token you provide:

• description – a human-readable label for the token
• role_names – one or more role names that determine the token's permissions
• expiration – one of AFTER_1_DAY, AFTER_7_DAYS, AFTER_30_DAYS, AFTER_90_DAYS, AFTER_365_DAYS, or NEVER

Important: The secret field is returned only at creation time and cannot be retrieved again. Store it immediately in a secure location.

In [ ]:

identity_service = IdentityService()

token_request = CreateTenantTokenRequest(
    description="My integration token",
    roleNames=["Data Admin", "Data Science User"],
    expiration="AFTER_30_DAYS",
)

tenant_token = identity_service.create_tenant_token(token_request)

print(f"Client ID : {tenant_token.client_id}")
print(f"Secret    : {tenant_token.secret}  # store this — shown only once")
print(f"Expires at: {tenant_token.expires_at}")
print(f"Roles     : {tenant_token.role_ids}")

identity_service = IdentityService() token_request = CreateTenantTokenRequest( description="My integration token", roleNames=["Data Admin", "Data Science User"], expiration="AFTER_30_DAYS", ) tenant_token = identity_service.create_tenant_token(token_request) print(f"Client ID : {tenant_token.client_id}") print(f"Secret : {tenant_token.secret} # store this — shown only once") print(f"Expires at: {tenant_token.expires_at}") print(f"Roles : {tenant_token.role_ids}")

Delete the Tenant Token¶

When the token is no longer needed, delete it by its client ID.

In [ ]:

identity_service.delete_tenant_token(id=tenant_token.client_id)

print(f"Tenant token {tenant_token.client_id} deleted.")

identity_service.delete_tenant_token(id=tenant_token.client_id) print(f"Tenant token {tenant_token.client_id} deleted.")

In [ ]: