1# export PINAX_PROJECT_ID='<your Pinax Project ID>' PINAX_API_KEY='<your Pinax API key>'
2set +x # Keep credentials and generated links out of shell tracing.
3# Set PINAX_OBJECT_KEY to a file selected from the current Delta snapshot.
4# Example shape: blocks/date=2020-01-01/<active-file>.parquet
5: "${PINAX_OBJECT_KEY:?Set the active object key}"
6export AWS_ACCESS_KEY_ID="${PINAX_PROJECT_ID:?Set your Project ID}"
7export AWS_SECRET_ACCESS_KEY="${PINAX_API_KEY:?Set your API key}"
8unset AWS_SESSION_TOKEN AWS_SECURITY_TOKEN
9export AWS_PROFILE=pinax-download
10aws configure set profile.pinax-download.s3.addressing_style path
11 
12# Signing is local. The URL permits GET for this object for five minutes.
13DOWNLOAD_URL="$(aws s3 presign "s3://eth/$PINAX_OBJECT_KEY" \
14  --endpoint-url 'https://datasets.s3.pinax.network' \
15  --region 'us-east-1' --expires-in 300)"
16 
17# This request reads data and bills the signing project's team.
18curl --fail --output ./dataset.parquet "$DOWNLOAD_URL"
19unset DOWNLOAD_URL
20# Do not use curl -I with a GET URL: HEAD requires its own signature.
21# Keep URLs private and out of logs; anyone holding one can reuse it until expiry.

1# export PINAX_PROJECT_ID='<your Pinax Project ID>' PINAX_API_KEY='<your Pinax API key>'
2# Set PINAX_OBJECT_KEY to a file selected from the current Delta snapshot.
3import os
4import boto3
5from botocore.config import Config
6 
7s3 = boto3.client(
8    "s3",
9    endpoint_url="https://datasets.s3.pinax.network",
10    region_name="us-east-1",
11    aws_access_key_id=os.environ["PINAX_PROJECT_ID"],
12    aws_secret_access_key=os.environ["PINAX_API_KEY"],
13    config=Config(
14        signature_version="s3v4",
15        s3={"addressing_style": "path"},
16        request_checksum_calculation="when_required",
17        response_checksum_validation="when_required",
18    ),
19)
20params = {"Bucket": "eth", "Key": os.environ["PINAX_OBJECT_KEY"]}
21 
22# No data is read when these URLs are created. GET and HEAD are signed separately.
23download_url = s3.generate_presigned_url(
24    "get_object", Params=params, ExpiresIn=300, HttpMethod="GET"
25)
26head_url = s3.generate_presigned_url(
27    "head_object", Params=params, ExpiresIn=300, HttpMethod="HEAD"
28)
29# Return download_url only to the authorized caller; never log either URL.
30# A normal browser link can open download_url. Browser fetch still needs CORS.

1// export PINAX_PROJECT_ID='<your Pinax Project ID>' PINAX_API_KEY='<your Pinax API key>'
2// Set PINAX_OBJECT_KEY to a file selected from the current Delta snapshot.
3// Install @aws-sdk/client-s3 and @aws-sdk/s3-request-presigner on your server.
4import { S3Client, GetObjectCommand, HeadObjectCommand } from "@aws-sdk/client-s3";
5import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
6 
7const s3 = new S3Client({
8  endpoint: "https://datasets.s3.pinax.network",
9  region: "us-east-1",
10  forcePathStyle: true,
11  credentials: {
12    accessKeyId: process.env.PINAX_PROJECT_ID,
13    secretAccessKey: process.env.PINAX_API_KEY,
14  },
15  requestChecksumCalculation: "WHEN_REQUIRED",
16  responseChecksumValidation: "WHEN_REQUIRED",
17});
18const object = { Bucket: "eth", Key: process.env.PINAX_OBJECT_KEY };
19 
20// These calls sign locally. Data is billed when someone uses the link.
21const downloadUrl = await getSignedUrl(s3, new GetObjectCommand(object), {
22  expiresIn: 300,
23});
24const headUrl = await getSignedUrl(s3, new HeadObjectCommand(object), {
25  expiresIn: 300,
26});
27// Return downloadUrl only to the authorized caller; never log either URL.
28// Use a normal <a href={downloadUrl} referrerPolicy="no-referrer"> link.
29// Keep the API key on your server. Do not add credentials to browser code.