Skip to content

Log in

A ComputeContext, the nanook CLI and local query profiling in the portal need a logged-in client. A ClusterContext connects to the cluster's scheduler directly and needs no login. Polars Nanook authenticates the polars-nanook Python client and the nanook CLI with short-lived access tokens from a browser login or a service account. The client has two login functions, and the CLI has the same two commands, nanook authenticate and nanook login:

  1. authenticate loads cached tokens when available and falls back to a browser login when needed. It is the recommended method for development, since it reuses existing sessions.
  2. login always starts a browser login. Use it to switch between accounts.
import polars_nanook as pn

pn.authenticate()

The API reference documents the authentication options.

Credential resolution

authenticate resolves credentials in the following order:

  1. NANOOK_ACCESS_TOKEN environment variable
  2. NANOOK_CLIENT_ID / NANOOK_CLIENT_SECRET service account environment variables
  3. Any cached access or refresh tokens

When the client finds none, it opens the browser to log in and get a new access token.

The client caches the tokens in polars_nanook/config.toml in the operating system's config directory, together with the default workspace and organization.

Log in from a job

In a CI/CD job or an orchestrator, set the service account variables and call pn.authenticate(interactive=False), so the job fails instead of waiting for a browser login.