Every request carries a Bearer token in the Authorization header. The client resolves the token from the first of these sources that is set:
  1. credentials= or api_key= passed to the client;
  2. a named profile=;
  3. the GWENLAKE_API_KEY environment variable;
  4. the default profile of ~/.gwenlake/credentials.
If none of them yields a token, the constructor raises a GwenlakeException.

​
API keys

An API key is a static token that identifies you and carries your permissions on the organizations and projects you belong to. Create and revoke keys from the platform. A key never expires on its own, so rotate it when it leaks.

​
The credentials file

~/.gwenlake/credentials (%APPDATA%\.gwenlake\credentials on Windows) is an INI file with one section per profile. A profile holds either a static token or an OAuth2 client_id and client_secret, and may name the endpoint it is for with base_url (or host: a bare host such as atlas.acme.example, completed to its API prefix), for a tenant deployed on its own host. hostname is something else: the OAuth server of a client-credentials profile.
~/.gwenlake/credentials
Pick a profile with Gwenlake(profile="myteam") or, on the command line, gwenlake --profile myteam .... The command line also writes the file: gwenlake config set-profile acme --token sk-... --base-url https://atlas.acme.example/v1 (see Command line).

​
OAuth2 clients

For a service that must not hold a personal key, use an OAuth2 client with the client-credentials flow. The library exchanges the client id and secret for a token against auth.gwenlake.com and refreshes it in the background, one minute before it expires.
creds.is_configured tells whether the credentials can produce a token, and creds.sign_out() revokes the current one.

​
Inside a build

Code run by the platform (a transform build, a training on the GPU pool) needs no key: the engine injects the build’s own identity, and the client picks it up. Keep your scripts free of credentials so the same file runs locally with your key and on the platform with the build’s.
Never commit API keys or client secrets to a repository. Prefer the environment variable or the credentials file, and keep the file readable by you only.