Reusing a token obtained from DeviceCodeCredential - python-3.x

Question

I am using the following code to obtain a token for azure blob service:
from azure.storage.blob import BlobServiceClient from azure.identity import InteractiveBrowserCredential, DeviceCodeCredential, ClientSecretCredential
credential = DeviceCodeCredential(authority="login.microsoftonline.com", tenant_id="***", client_id="***")
blobber = BlobServiceClient(account_url="https://***.blob.core.windows.net", credential=credential)
blobs = blobber.list_containers()
for b in blobs:
print(b)
It works perfectly.
However, during a certain timeframe, a user may need to invoke the blob service more than once. The key point is that the process may close and reopen several times.
Making the user go through the interactive token acquisition process each time the process restarts would be very annoying. I would like to persist the token and reuse it in later flows until it expires (assume persistence is secure).
What type of credential should I use? ClientSecretCredential doesn't work. Alternatively, perhaps there is a token cache mechanism I am not aware of.
EDIT:
I reposted a variation of this question. It also has a working answer.
Thank you Jim Xu.

Answer 1

According to my research, the DeviceCodeCredential doesn't cache tokens--each get_token(*scopes, **kwargs) call begins a new authentication flow.
According to your need, you can use ClientSecretCredential. Regarding how to implement it, please refer to the following steps
Create a service principal and assign Azure RABC role(such as Storage Blob Data Owner Storage Blob Data Contributor and Storage Blob Data Reader) to it to do Azure AD auth and access Azure blob storage. For more details, please refer to the document and the document
I use Azure CLI
#create a sevice pricipal and assign Storage Blob Data Contributor role at storage account level
az login
az ad sp create-for-rbac -n "MyApp" --role "Storage Blob Data Contributor" \
--scope "/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>" --sdk-auth
# just assign Storage Blob Data Contributor role at storage account level
az role assignment create --assignee <sp_name> --role "Storage Blob Data Contributor role"
--scope "/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>"
Code
from azure.identity import ClientSecretCredential
token_credential = ClientSecretCredential(
sp_tenant_id,
sp_application_id,
sp_application_secret
)
# Instantiate a BlobServiceClient using a token credential
from azure.storage.blob import BlobServiceClient
blob_service_client = BlobServiceClient(account_url=self.oauth_url, credential=token_credential)
blobs = blob_service_client.list_containers()
for b in blobs:
print(b)