Geoinsight Authentication

generated: '2026-08-20'
method: searched
source: https://pypi.org/project/geoinsight/
spec_source: openapi/geoinsight-ogc-api-dggs-openapi.yml
docs: https://pypi.org/project/geoinsight/
name: GeoInsight Authentication Profile
description: >-
  GeoInsight's published OpenAPI declares NO components.securitySchemes and NO top-level security
  requirement, so the machine-readable contract says nothing about authentication. The credential model is
  documented only in the README of the first-party PyPI package: a GeoInsight Personal Token (GPT) and an
  API Private Key (APK), obtained by creating an account on the dashboard, then set with
  api.set_access_token(_gpt='GPT', _apk='APK'). The package depends on auth0-python, which indicates the
  token issuance path runs through Auth0. Neither the wire format (header name, scheme, encoding) nor the
  token lifetime is published anywhere machine- or human-readable that could be found.
summary:
  types: []
  api_key_in: []
  oauth2_flows: []
  spec_declares_security: false
  note: >-
    The empty lists are the finding, not a gap in this artifact. The spec genuinely declares no
    securityScheme.
schemes: []
documented_credentials:
  - name: GeoInsight Personal Token (GPT)
    abbreviation: GPT
    issued_by: https://dashboard.geoinsight.ai
    documented_in: https://pypi.org/project/geoinsight/
    wire_format: unpublished
    note: >-
      Set client-side via geoinsight.api().set_access_token(_gpt=..., _apk=...). The header or query
      parameter the SDK puts it on is not documented and there is no source repository to read it from.
  - name: API Private Key (APK)
    abbreviation: APK
    issued_by: https://dashboard.geoinsight.ai
    documented_in: https://pypi.org/project/geoinsight/
    wire_format: unpublished
identity_provider:
  vendor: Auth0
  evidence: >-
    The official PyPI package geoinsight 0.8.1 declares auth0-python>=4.4.2 as a runtime dependency.
  confidence: medium
  note: Inferred from the dependency list, not from a GeoInsight statement. No OIDC discovery document is served.
observed_behaviour:
  anonymous_reads: true
  evidence:
    - {url: 'https://api.geoinsight.ai/', status: 200, note: Landing page document returned without credentials}
    - {url: 'https://api.geoinsight.ai/collections?f=json', status: 200, note: 22 collections returned without credentials}
    - {url: 'https://api.geoinsight.ai/dggs?f=json', status: 200, note: DGGRS registry returned without credentials}
    - {url: 'https://api.geoinsight.ai/api?f=json', status: 200, note: OpenAPI document returned without credentials}
  note: >-
    Every operation reachable during this pass answered anonymously. No 401 or 403 was observed on any
    path. It is not possible to tell from the outside whether the GPT/APK pair gates a subset of
    collections, raises quota, or is simply not yet enforced on this deployment.
credential_path_status:
  reachable: false
  url: https://dashboard.geoinsight.ai
  http_status: 404
  note: >-
    The dashboard the package README names as the place to obtain a GPT and APK returns an nginx
    "default backend - 404" on every path behind a self-signed Kubernetes ingress certificate. A
    developer following the official install instructions today cannot obtain credentials.
gaps:
  - No securitySchemes in the OpenAPI, so no generated client can authenticate from the contract.
  - No documented header name or scheme for the GPT/APK pair.
  - No token lifetime, rotation or revocation policy published.
  - No OIDC or OAuth discovery document on any host (see well-known/geoinsight-well-known.yml).
  - The documented credential-issuance host is unreachable.