Authenticate
Lattice supports two authentication methods: OAuth 2.0 client credentials using short-lived access token, environment token authentication, using long-lived, static access tokens.
Environment token
Client credentials
The environment token is a long-lived, static bearer token you use the token to authenticate with Lattice. You must rotate the token before it expires:
The following steps show how to authenticate using both client credentials and long-lived environment tokens with both REST and gRPC SDKs.
Before you begin
- Set up the Lattice SDK.
- If you are using Lattice Sandboxes, see the Sandboxes set up guide. If you are using a Lattice deployment other than Sandboxes, obtain your Lattice endpoint and access credentials from your Anduril representative.
Get the Lattice endpoint
To store the Lattice endpoint as a system environment variable, do the following:
Get your credentials
To store your credentials as system environment variables, do the following:
Sandboxes token
If you’re connecting to Sandboxes:
This is required for Sandboxes whether you use client credentials, or an environment token. If you do not have a Sandboxes token, create a new token.
Environment token
Bearer token authentication uses a long-lived, static token to authenticate requests. Use this method when your deployment provides a static access token rather than OAuth 2.0 client credentials.
Using REST
Pass the token directly to the client constructor using the token parameter:
Using gRPC
For gRPC, attach the bearer token as metadata on every outgoing request. Most gRPC client libraries provide a credentials or interceptor mechanism for this purpose:
Client credentials
OAuth 2.0 client credentials is in beta and not widely deployed in production.
If you’re developing an integration in a production Lattice environment, check with your Anduril representative if
OAuth 2.0 is available.
When you use OAuth, Lattice exchanges your credentials for a short-lived access token using the Lattice OAuth REST endpoint:
Using REST
The REST SDK handles fetching a new access token automatically. Pass your client ID and secret when you initialize the client:
Using gRPC
Since gRPC does not provide built-in OAuth token management, implement a ClientCredentialsAuth
module that fetches an access token, caches it, and refreshes it before it expires:
Then, use this module to handle fetching new tokens when you interact with Lattice:
These examples refresh the access token before it expires (with a buffer of approximately five minutes). Each gRPC call invokes the helper function, which checks the cache and refreshes the token if needed.
What’s next?
- See Connect to offline environments to configure self-signed certificates.
- Learn how to publish entities to Lattice.
- Explore tasking to learn how to task an agent in Lattice.