Credential

class couchbase_analytics.credential.Credential(*, username: str | None = None, password: str | None = None, jwt_token: str | None = None, cert_path: str | None = None, key_path: str | None = None, cert_password: str | None = None)

A credential for authenticating with a Couchbase Analytics endpoint.

Construct via a factory classmethod or direct keyword arguments:

Credential(username='Administrator', password='swordfish')
Credential(jwt_token='eyJ...')
Credential(cert_path='/path/to/cert.pem', key_path='/path/to/key.pem')
Credential(cert_path='/path/to/client.p12', cert_password='secret')
Credential.from_username_and_password('Administrator', 'swordfish')
Credential.from_jwt('eyJ...')
Credential.from_certificate('/path/to/cert.pem', '/path/to/key.pem')
Credential.from_certificate('/path/to/client.p12', password='secret')
Credential.from_callable(lambda: Credential.from_jwt(get_token()))
classmethod from_username_and_password(username: str, password: str)

Create a Credential from a username and password.

Parameters:

  • username (str) – The username for the Analytics endpoint.

  • password (str) – The password for the Analytics endpoint.

Return type:

Credential

classmethod from_jwt(token: str)

Create a Credential from a JSON Web Token (JWT).

The SDK sends an Authorization: Bearer <jwt> header on every HTTP request. JWT credentials may only be used with an https:// endpoint.

Note

JWT credentials have a limited validity period. To avoid authentication failures, periodically pass a fresh credential via set_credential().

Parameters:

token (str) – The JSON Web Token.

Return type:

Credential

classmethod from_certificate(cert_path: str, key_path: str | None = None, *, password: str | None = None)

Create a Credential for client-certificate (mTLS) authentication.

Two file layouts are accepted:

  • PEM cert + PEM key. Pass both paths:

    Credential.from_certificate('/path/cert.pem', '/path/key.pem')

    password decrypts the key file if it’s encrypted.

  • PKCS#12 bundle (.p12 / .pfx). Pass only cert_path:

    Credential.from_certificate('/path/client.p12', password='secret')

    Use password=None (the default) if the file is unencrypted.

Authentication happens during the TLS handshake; no HTTP Authorization header is sent. Cert credentials may only be used with an https:// endpoint.

Note

Rotating a cert credential via set_credential() rebuilds the HTTP client, since the cert is baked into the SSL context.

Parameters:

  • cert_path (str) – Path to a PEM-encoded certificate (chain) or a PKCS#12 bundle.

  • key_path (Optional[str]) – Path to the PEM-encoded private key. None if cert_path is a PKCS#12 bundle that already contains the key.

  • password (Optional[str]) – Decryption password for the PEM key file or PKCS#12 bundle. None if the file is unencrypted.

Return type:

Credential

classmethod from_callable(callback: Callable[[], Credential])

Create a Credential by invoking a callback.

The callback is invoked once at construction time; it is not retained for dynamic credential lookup. To pick up a refreshed credential later, pass a fresh Credential to set_credential().

Parameters:

callback (Callable[[], Credential]) – Callback that returns a Credential.

Return type:

Credential

Example:

cred = Credential.from_callable(
    lambda: Credential.from_username_and_password(
        os.environ['USERNAME'], os.environ['PASSWORD']
    )
)