Error 403: Invalid or expired account with Exploration Pack

I am getting the error 403: {“error”:{“status”:403,“reason”:“Forbidden”,“message”:“Invalid or expired account.”,“code”:“COMMON_INSUFFICIENT_PERMISSIONS”}}

I bought the exploration package and should be therefore able to use the API, but still cant.

I already tried two times to delete and recreate OAuth id and secret.

Code:

from oauthlib.oauth2 import BackendApplicationClient
from requests_oauthlib import OAuth2Session

# Your client credentials
client_id = 'secret'
client_secret = 'secret'

client = BackendApplicationClient(client_id=client_id)
oauth = OAuth2Session(client=client)

token = oauth.fetch_token(
    token_url='https://services.sentinel-hub.com/oauth/token',
    client_id=client_id,
    client_secret=client_secret
)
resp = oauth.get("https://services.sentinel-hub.com/oauth/tokeninfo")
print(resp.content)

def sentinelhub_compliance_hook(response):
    response.raise_for_status()
    return response

oauth.register_compliance_hook("access_token_response", sentinelhub_compliance_hook)






evalscript = """
//VERSION=3
function setup() {
  return {
    input: ["B02", "B03", "B04"],
    output: { bands: 3 },
  }
}

function evaluatePixel(sample) {
  return [2.5 * sample.B04, 2.5 * sample.B03, 2.5 * sample.B02]
}
"""

request = {
    "input": {
        "bounds": {
            "properties": {"crs": "http://www.opengis.net/def/crs/OGC/1.3/CRS84"},
            "bbox": [
                        [13.2042218, 51.1035219],  # Punkt 1 (lng, lat)
                        [13.8472199, 51.1035219],  # Punkt 2 (lng, lat)
                        [13.8472199, 51.0362128],  # Punkt 3 (lng, lat)
                        [13.2042218, 51.0362128],  # Punkt 4 (lng, lat)
                        [13.2042218, 51.1035219]   # Punkt 1 (lng, lat) - geschlossen
                    ],
        },
        "data": [
            {
                "type": "sentinel-2-l2a",
                "dataFilter": {
                    "timeRange": {
                        "from": "2023-10-31T00:00:00Z",
                        "to": "2023-10-01T00:00:00Z",
                    }
                },
            }
        ],
    },
    "output": {
        "width": 512,
        "height": 512,
    },
    "evalscript": evalscript,
}

url = "https://sh.dataspace.copernicus.eu/api/v1/process"
response = oauth.post(url, json=request, headers={"Accept": "image/tiff"})


# saving response
import os

output_directory = 'database/'
output_filename = 'sentinel_output.tiff'

if not os.path.exists(output_directory):
    os.makedirs(output_directory)

output_path = os.path.join(output_directory, output_filename)

if response.status_code == 200:
    with open(output_path, 'wb') as file:
        file.write(response.content)
    print(f'Datei gespeichert: {output_path}')
else:
    print(f"Error: {response.status_code}")
    print(response.text)

It seems you are mixing two of the separate deployments of Sentinel Hub - one on sentinel-hub.com and one on dataspace.copernicus.eu

Your Exploratory account is for the moment tied to sentinel-hub.com. If you would like us to transfer it to datasoace.copernicus.eu, we can do so. In either case you will have to correct your script to use only one endpoint for the services.

This part should be
url = “https://services.sentinel-hub.com/api/v1/process

So in order to use the Process API, I am only allowed to use the dataspace.copernicus.eu?

Autorization then has to be switched in this way?:

https://documentation.dataspace.copernicus.eu/APIs/Token.html

And is there then any need to pay for the information, because I see no pricing.

With your fix the following error occurs:

Error: 400
Cannot deserialize instance of `[D` out of START_ARRAY token
 at [Source: (org.glassfish.jersey.message.internal.ReaderInterceptorExecutor$UnCloseableInputStream); line: 1, column: 103] (through reference chain: com.sinergise.sentinel.api.process.request.ProcessRequest["input"]->com.sinergise.sentinel.api.process.request.Input["bounds"]->com.sinergise.sentinel.api.process.request.Bounds["bbox"]->double[][0])

No, no.
With your current subscription you can make use of all services on sentinel-hub.com. If you want to use Process API, you simply use
https://services.sentinel-hub.com/api/v1/process
instead of
https://sh.dataspace.copernicus.eu/api/v1/process

If, however, you would like to use the Sentinel Hub services on dataspace.copernicus.eu, you need to have an account there (up to some quota it is free of charge, then you can make use of the same payable Sentinel Hub packages), you need to do this consistently
i.e.
token_url='https://services.sentinel-hub.com/oauth/token
should be
token_url='https://sh.dataspace.copernicus.eu/oauth/token

  • Make sure that you are using the correct Sentinel Hub API endpoint. For the exploration package, you should use the https://sh.dataspace.copernicus.eu/api/v1/process endpoint.
  • Make sure that you are setting the Accept header to image/tiff. This is required in order to receive a TIFF image response.
  • Try increasing the timeout parameter in the oauthlib library. This may be necessary if the Sentinel Hub API is responding slowly.

Here is an example of how to increase the timeout parameter:

Pythonimport oauthlib.oauth2

# Increase the timeout to 60 seconds
client = oauthlib.oauth2.BackendApplicationClient(client_id=client_id, timeout=60)
oauth = OAuth2Session(client=client)

If you are still unable to resolve the issue, please contact Sentinel Hub support for assistance.

Hello,

I got the same error using Process API. I have just started my trial period and I’m following the instructions to work on a large area with multiple requests.

The code is pretty long so here are some snapshots that I think matter:

SHConfig(
  instance_id='',
  sh_client_id='********************************8ff8',
  sh_client_secret='************************************^S{u',
  sh_base_url='https://services.sentinel-hub.com',
  sh_auth_base_url='https://services.sentinel-hub.com',
  sh_token_url='https://services.sentinel-hub.com/oauth/token',
  geopedia_wms_url='https://service.geopedia.world',
  geopedia_rest_url='https://www.geopedia.world/rest',
  aws_access_key_id='',
  aws_secret_access_key='',
  aws_session_token='',
  aws_metadata_url='https://roda.sentinel-hub.com',
  aws_s3_l1c_bucket='sentinel-s2-l1c',
  aws_s3_l2a_bucket='sentinel-s2-l2a',
  opensearch_url='http://opensearch.sentinel-hub.com/resto/api/collections/Sentinel2',
  max_wfs_records_per_query=100,
  max_opensearch_records_per_query=500,
  max_download_attempts=4,
  download_sleep_time=5.0,
  download_timeout_seconds=120.0,
  number_of_download_processes=1,
)`

I have succeeded in generating the dl_requests, but downloading brings up the below error

downloaded_data = SentinelHubDownloadClient(config=config).download(dl_requests, max_threads=5)
DownloadFailedException: Failed to download from:
https://services-uswest2.sentinel-hub.com/api/v1/process
with HTTPError:
403 Client Error: Forbidden for url: https://services-uswest2.sentinel-hub.com/api/v1/process
Server response: "{"status": 403, "reason": "Forbidden", "message": "Invalid or expired account.", "code": "COMMON_INSUFFICIENT_PERMISSIONS"}"

Hi @hassansalehx ,

Could you make sure you’re using the correct sh_client_id and sh_client_secret? I’ve looked into your trial account linked to hassansalehx@MASKED and there’s no OAuth client ended with 8ff8 as you set in your SHConfig. The active OAuth client is ended with 6a03. Please try to use it or create a new OAuth client if you lose the secret of the one ended with 6a03.

1 Like

Thank you, Chung. For some reason, the id and secret key were not updated in the config file. It’s working just fine now.

Best
Hassan

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.