Auto-authentication consumes KAGGLE_API_TOKEN before user code runs

[djhuangit]

Description

The kaggle/__init__.py auto-authenticates on import and removes KAGGLE_API_TOKEN from the environment. This breaks programmatic usage - users cannot create their own KaggleApi() instance because the token is already consumed.

Environment

• kaggle: 1.8.2
• Python: 3.13.5
• OS: macOS

Steps to Reproduce

Using the officially documented pattern from the README:

import os
os.environ["KAGGLE_API_TOKEN"] = "KGAT_xxxxx"

# Official pattern from README:
import kaggle
from kaggle.api.kaggle_api_extended import KaggleApi

api = KaggleApi()
api.authenticate()
# Fails - token was already consumed by `import kaggle`

Root Cause

Two things combine to cause this:

1. kaggle/__init__.py auto-authenticates on import:

api = KaggleApi(enable_oauth=enable_oauth)
api.authenticate()

2. _authenticate_with_access_token() removes the token after use:

os.environ.pop("KAGGLE_API_TOKEN", None)

Workaround

Use the pre-authenticated API instance from kaggle module instead of creating a new one:

# Instead of:
from kaggle.api.kaggle_api_extended import KaggleApi
api = KaggleApi()
api.authenticate()

# Use:
import kaggle
api = kaggle.api  # Already authenticated on import

# Then use normally:
files = api.dataset_list_files("uciml/iris")
api.dataset_download_files("uciml/iris", path="./data")

[Ash-Blanc]

bro thnx tho are u able to do api.competitions_list()

[djhuangit]

@Ash-Blanc Yes I tested and it worked. Here is the minimal working example:

"""
Bug: KAGGLE_API_TOKEN is deleted on import, breaking new KaggleApi() instances.

Usage: KAGGLE_API_TOKEN="KGAT_xxxxx" python reproduce_token_deletion.py
"""
import os
os.environ["KAGGLE_API_TOKEN"] = os.environ.get("KAGGLE_API_TOKEN", "KGAT_xxxxx")

print(f"Before import: KAGGLE_API_TOKEN = {os.environ.get('KAGGLE_API_TOKEN')}")
import kaggle 
print(f"After import:  KAGGLE_API_TOKEN = {os.environ.get('KAGGLE_API_TOKEN', 'DELETED')}")

# Bug: new KaggleApi() fails - token already consumed
print("\n--- Bug ---")
from kaggle.api.kaggle_api_extended import KaggleApi  # noqa: E402
api = KaggleApi()
try:
    api.authenticate()
except BaseException:
    print("^^^ KaggleApi().authenticate() failed - token was consumed on import")

# Workaround: use pre-authenticated kaggle.api
print("\n--- Workaround: use kaggle.api ---")
files = kaggle.api.dataset_list_files("uciml/iris")
print(f"dataset_list_files: {len(files.files)} files")
comps = kaggle.api.competitions_list().competitions[:2]
print(f"competitions_list: {comps[0].title}")

[stevemessick]

@djhuangit Does this issue still cause problems in v1.8.3?

[djhuangit]

@stevemessick I have tested using this code with v1.8.3 and the issue still persists:

@Ash-Blanc Yes I tested and it worked. Here is the minimal working example:

"""
Bug: KAGGLE_API_TOKEN is deleted on import, breaking new KaggleApi() instances.

Usage: KAGGLE_API_TOKEN="KGAT_xxxxx" python reproduce_token_deletion.py
"""
import os
os.environ["KAGGLE_API_TOKEN"] = os.environ.get("KAGGLE_API_TOKEN", "KGAT_xxxxx")

print(f"Before import: KAGGLE_API_TOKEN = {os.environ.get('KAGGLE_API_TOKEN')}")
import kaggle
print(f"After import: KAGGLE_API_TOKEN = {os.environ.get('KAGGLE_API_TOKEN', 'DELETED')}")

Bug: new KaggleApi() fails - token already consumed

print("\n--- Bug ---")
from kaggle.api.kaggle_api_extended import KaggleApi # noqa: E402
api = KaggleApi()
try:
api.authenticate()
except BaseException:
print("^^^ KaggleApi().authenticate() failed - token was consumed on import")

Workaround: use pre-authenticated kaggle.api

print("\n--- Workaround: use kaggle.api ---")
files = kaggle.api.dataset_list_files("uciml/iris")
print(f"dataset_list_files: {len(files.files)} files")
comps = kaggle.api.competitions_list().competitions[:2]
print(f"competitions_list: {comps[0].title}")

Here is the terminal output:

[anowardear062-svg]

Support and proses

[anowardear062-svg]

Support and proses

[stevemessick]

@djhuangit Thanks for the info. I'm not sure why we delete the token after using it. But, your work-around seems to solve the problem. We should probably update the docs to suggest doing that instead of reinstantiating KaggleApi. Although, IMO, that should work, too.

[djhuangit]

@stevemessick Thanks for getting back! My guess is that the token is deleted for safety reasons, so that nobody can access the api key after authentication?