Automation with API tokens

GENI Workflows can issue API tokens so that scripts manage workflows and submissions without a password.

What a token can and cannot do

A token can manage workflows and submissions. It cannot manage users or cloud resources.

To submit, the token must have been created against a specific environment.

Use a token

Set the environment variable and the CLI authenticates with it:

export GENI_API_TOKEN=<api-token>
geni submission list

GENI_API_TOKEN takes precedence over the credentials in ~/.geni/credentials.json, so the same machine can run interactive work as you and scheduled work as the token.

In CI

env:
  GENI_API_TOKEN: ${{ secrets.GENI_API_TOKEN }}
steps:
  - run: npm install -g geni-bioinfo
  - run: |
      geni submission create \
        --workflow-name wgs-germline \
        --workflow-version v2.1.0 \
        --params-file sample.json \
        --engine-id "$ENGINE_ID" \
        --queue-id "$QUEUE_ID" \
        --output-folder "s3://lab-results/${RUN_ID}/" \
        --tag client=acme \
        --format json