Conda channel token authentication and anaconda-client token management: integration challenges for credential rotation

Answer the question first

To give Conda a short‑lived, least‑privilege token without persisting it in .condarc, wrap every conda invocation with a script that:

• Pulls a fresh token from a secrets store or anaconda-client API.
• Temporarily sets an environment variable (e.g. ANACONDA_TOKEN) or writes a one‑time file.
• Transforms the channel name in the command line into a fully authenticated URL that includes the token.
• Clears the variable or deletes the file after the command exits.

Because Conda reads the URL from the command line, the token never ends up in the user’s config or in conda info output. Logs can be sanitized to avoid accidental leakage.

Typical wrapper implementation (Bash)

# /usr/local/bin/conda-wrapper
set -e
# 1. Obtain a short‑lived token (15‑min JWT) via anaconda-client or vault
export ANACONDA_TOKEN=$(anaconda-client token create --expires 900 --output json | jq -r .access_token)

# 2. Build the authenticated channel URL
CHANNEL="myprivatechannel"
TOKENIZED_URL="https://api.anaconda.org/channel/${CHANNEL}?token=${ANACONDA_TOKEN}"

# 3. Replace the channel name in the original command
CMD=(conda "$@")
for i in "${!CMD[@]}"; do
  if [[ ${CMD[$i]} == "${CHANNEL}" ]]; then
    CMD[$i]="$TOKENIZED_URL"
  fi
done

# 4. Execute and clean up
exec "${CMD[@]}"
# token is cleared automatically when the shell exits

Automated expiry detection and rotation

Because Conda offers no built‑in expiry hooks, the wrapper itself must check the token’s exp claim before each run. If the current time is within N minutes of expiry, the wrapper pre‑emptively generates a new token and updates the environment variable. A separate CI job can also perform a health check by querying the token endpoint and, if the token is about to expire, regenerating it and writing a new value to the secrets store.

Steps for a CI pipeline

1. Generate a short‑lived token in a dedicated job that calls anaconda-client token create.
2. Export the token as an environment variable for subsequent jobs, or store it in a vault secret that the wrapper can read.
3. Run conda through the wrapper in each job that needs package installation.
4. Clear the variable after the job completes (most CI runners do this automatically for job‑scoped env vars).
5. Schedule a rotation job that runs every X minutes (e.g., every 10 min) to refresh the token if it is within Y minutes of expiry.

Why this is a best practice

• Least privilege: Tokens can be scoped to a single channel and short‑lived, limiting damage if leaked.
• No static configuration: .condarc never contains secrets, reducing accidental exposure.
• Clear diagnostics: The wrapper can log a specific “token expired” message, instead of the generic 404 or package‑not‑found errors that Conda emits.
• Automation friendly: CI steps and cron jobs can refresh tokens without manual intervention.

What we still need to know

To fine‑tune the rotation interval and expiry threshold, could you share the typical lifetime you prefer for channel tokens and whether you use anaconda-client or a vault API to fetch them?