Dev GuideAPI Reference
Dev GuideAPI ReferenceUser GuideGitHubNuGetDev CommunitySubmit a ticketLog In
GitHubNuGetDev CommunitySubmit a ticket

Authentication API

Information about the steps necessary to access your Experimentation Events Export using the Optimizely Experimentation Authentication API.

The simplest and fastest way to access your Experimentation Events Export is by using our Authentication API, where you can exchange an Optimizely Experimentation-issued token for temporary AWS credentials. These credentials can then be used to access the Experimentation Events S3 buckets associated with your account, where you can programmatically download your data.


Optimizely Experimentation Authentication API endpoint

Query Parameters

durationThis is the expiration window for your credentials. The default and the maximum value is 1 hour. You may select anything between 15 minutes and 1 hour for this parameter, using [H,h] for hours or [M,m] for minutes.


Refresh these credentials as often as needed using your original Personal Access Token.


Complete Optimizely Experimentation REST API reference.

Instructions on acquiring temporary AWS credentials with the Authentication API

Step 1: Generate a Personal Access Token.

Generate a Personal Access Token (PAT) within the Optimizely application by following the Support documentation instructions.

Step 2: Make a request to the Optimizely Authentication API using your PAT.

Copy your Personal Access Token (PAT) into the Authorization header of a GET request sent to the Optimizely Experimentation Authentication API's /export/credentials endpoint:

Sample cURL request:

curl -H "Authorization: Bearer {PAT}" -X GET\?duration\=1h

Sample response:

 "credentials": {
   "accessKeyId": "access_key_id",
   "secretAccessKey": "access_secret_key",
   "sessionToken": "session_token",
   "expiration": 1591026407394
 "s3Path": "s3://optimizely-events-data/v1/account_id=123"

The response contains an accessKeyId, a secretAccessKey and a sessionToken, which you will use in the next step to validate your credentials.



You can skip this step if you already have credentials for the other data export services. You can reuse the same credentials to access your Experimentation Events Export data, though those credentials will be less secure than the ones issued using the above method.

Step 3: Validate your credentials.

Verify you can access Experimentation Events Export data using your credentials:

  1. Install AWS command line tools.

  2. Export your accessKeyId, secretAccessKey and sessionToken as environment variables:

    export AWS_ACCESS_KEY_ID={access_key_id}
    export AWS_SECRET_ACCESS_KEY={access_secret_key}
    export AWS_SESSION_TOKEN={session_token}

  3. Copy your Optimizely Account ID. For information on accessing your Account ID view the support documentation on account name, id, and multi-account-login in Optimizely Experimentation.

  4. List the files in your S3 decisions directory, using your account id and a given date:

    aws s3 ls s3://optimizely-events-data/v1/account_id=<account id>/type=decisions/date=<YYYY-MM-DD>/

    You should see a list of all experiments for which users received decisions that day.



The final forward-slash is necessary because your credentials will only provide access to one folder inside the Optimizely Experimentation Amazon S3 bucket.

  1. Since your Data Export data is encrypted, inspect and access the data with one of the following clients:
    1. AWS CLI version 1.11.108 and later
    2. AWS SDKs released after May 2016

Step 4: Start pulling down your data

When setting up access to your Experimentation Events data programmatically, you will need the accessKeyID, secretAccessKey, and sessionToken values from the Authentication API collected from Step 2 to be able to copy files from Optimizely Experimentation’s S3 buckets over to your own. These credentials expire every hour, so you need to set up a process for refreshing them. For more information, refer to the AWS documentation.

Sample code

Sample code for a boto3 S3 client that uses the Optimizely Experimentation Authentication API and refreshes credentials once an hour:

#!/usr/bin/env python3

from botocore.credentials import RefreshableCredentials
from botocore.session import get_session
from datetime import datetime
import requests as r
import boto3
import pytz
import sys

class BearerAuth(r.auth.AuthBase):
    Bearer authentication class that integrates with requests'
    native authentication mechanism.

    def __init__(self, token):
            token (str): Bearer token used to authenticate requests to an API
        self.token = token

    def __call__(self, request):
        """Sets the Authorization header on the current HTTP request.
            request (request): The current HTTP request object.
            request: The current HTTP request with additional
                     Authorization header
        request.headers['Authorization'] = f"Bearer {self.token}"
        return request

class OptimizelyS3Client(object):
    AWS S3 client using credentials from Optimizely


    def __init__(self, token: str):
            token (str): Optimizely personal access token
        self.token = token

    def get_bucket_prefix(self, account_id: str) -> str:
        """Get the bucket prefix for a given Optimizely account ID
            account_id (str): Optimizely account ID
            str: The S3 bucket prefix to access events data
        return f"v1/account_id={account_id}/"

    def get_creds(self) -> dict:
        """Get AWS credentials from the Optimizely public API
            dict: The AWS credentials for a given Optimizely account
        response = r.get(

        node = response.json()
        return node['credentials']

    def as_boto3_s3_client(self):
        Convert the Optimizely S3 client to a standard boto s3
        client with refreshable credentials
            botocore.client.S3: Standard boto3 S3 client
        creds = self.get_creds()

        # The API response is in milliseconds
        expiry_time = int(creds['expiration'] / 1000)

        # boto expects the expiry time to be a UTC datetime
        expiry_time = datetime.fromtimestamp(expiry_time, pytz.utc)

        opz_refreshable_credentials = RefreshableCredentials(

        session = get_session()
        session._credentials = opz_refreshable_credentials
        session.set_config_variable('region', OptimizelyS3Client.EVENT_EXPORT_BUCKET_REGION)
        opz_session = boto3.Session(botocore_session=session)
        s3_client = opz_session.client('s3')

        return s3_client

def main():
    EVENT_EXPORT_BUCKET_NAME = 'optimizely-events-data'
    OPTIMIZELY_ACCOUNT_ID = '8506653257'

    optimizely_s3_client = OptimizelyS3Client(OPTIMIZELY_PERSONAL_ACCESS_TOKEN)
    s3_client = optimizely_s3_client.as_boto3_s3_client()

    all_objects = s3_client.list_objects(

if __name__ == '__main__':