Aborting load due to failure while reading: https://sentinel2l2a01.blob.core.windows.net

[Lucas Srigley (lucas-srigley)]

... from collection sentinel-2-l2a due to error: HTTP response code: 403

[Seongjun Lee (SeongjunLee4473)]

Hey! That 403 is coming from Azure Blob Storage, not from the STAC API. On the Planetary Computer the STAC search is open to everyone, but the actual files (like the sentinel2l2a01.blob.core.windows.net ones) need a SAS token appended to the URL. If the hrefs aren't signed, or the token has expired, you get exactly this 403.

Easiest fix is to sign everything when you open the catalog:

import planetary_computer
import pystac_client

catalog = pystac_client.Client.open(
    "https://planetarycomputer.microsoft.com/api/stac/v1",
    modifier=planetary_computer.sign_inplace,
)

The "Aborting load due to failure while reading" part looks like it's from odc-stac, so you can also let it sign each URL right before it reads:

import odc.stac

data = odc.stac.load(items, bands=["B04", "B08"], patch_url=planetary_computer.sign)

A couple of other things worth checking:

• Tokens do expire. If it worked at first and started failing partway through a long run, or you're reusing items you signed a while ago, just sign them again. planetary_computer.sign keeps a cache and only asks for a new token when the old one is about to run out.
• Token lifetime and rate limits are more generous if you set a subscription key (planetarycomputer configure or the PC_SDK_SUBSCRIPTION_KEY env var) or run your code in West Europe.
• If you'd rather skip a bad file than have the whole load fail, there's fail_on_error=False in odc.stac.load. Just keep in mind you'll end up with gaps.

Docs on the token stuff are here: https://planetarycomputer.microsoft.com/docs/concepts/sas/

Hope that sorts it out :)