Skip to main content

Request authentication

Open in Markdown

Depending on the product or its resource, the following are used to work with Selectel product APIs and authenticate requests instead of a username and password:

You can find the URL for requests in the Authentication section of the URL List manual.

You can limit access to the API for endpoints that include https://api.selectel.ru.

Account-scoped IAM token (X-Auth-Token)

The token is passed in the X-Auth-Token. header.

An IAM token for an account (iam_token_account_scoped) provides access to managing most Selectel products and OpenStack API objects on par with a username and password in the my.selectel.ru Control Panel. It allows managing account resources.

Token lifetime is 24 hours.

The token allows managing:

Get an IAM token for an account

To use in working tools, create a service user and use it to get an IAM token for an account. To copy or reissue a Control Panel user's IAM token, use the Manage IAM Tokens section of the Manage Access Keys manual. We recommend using Control Panel user IAM tokens for testing only.

To get an IAM token for an account, the user must have a permission with the Account scope selected.

For your information

If you are using Windows, replace single quotes ('') in requests with double quotes (""). We also recommend using PowerShell for requests instead of CMD.

  1. Send the following request:
 curl -i -XPOST \
 -H 'Content-Type: application/json' \
 -d '{"auth":{"identity":{"methods":["password"],"password":{"user":{"name":"<username>","domain":{"name":"<account_id>"},"password":"<password>"}}},"scope":{"domain":{"name":"<account_id>"}}}}' \
 'https://cloud.api.selcloud.ru/identity/v3/auth/tokens'

Specify:

  • <username> — service user name. You can view the name in the Control Panel: in the top menu, click IAM → the Service Users section (the section is available only to the Account Owner and a user with the iam.admin role);
  • <account_id> — account number. You can find it in the Control Panel in the upper-right corner;
  • <password> — service user password; you can view it when creating a user or change it to a new one.

Upon successful authorization, a response with code 201 Created will be returned in the following format:

HTTP/2 201
X-Subject-Token: token
  1. Find the token in the X-Subject-Token header.

Project-scoped IAM token (X-Auth-Token)

The token is passed in the X-Auth-Token. header.

An IAM token for a project (iam_token_project_scoped) provides access to managing most Selectel products and OpenStack API objects on par with a username and password in the my.selectel.ru Control Panel. It allows managing project resources.

Token lifetime is 24 hours.

The token allows managing:

Get an IAM token for a project

To use in working tools, create a service user and use it to get an IAM token for a project. To copy or reissue a Control Panel user's IAM token, use the Manage IAM Tokens section of the Manage Access Keys manual. We recommend using Control Panel user IAM tokens for testing only.

To get an IAM token for a project, the user must have a permission where:

  • the Account scope is selected;
  • or the Projects scope is selected and the required project is selected.
For your information

If you are using Windows, replace single quotes ('') in requests with double quotes (""). We also recommend using PowerShell for requests instead of CMD.

  1. Send the following request:
 curl -i -XPOST \
 -H 'Content-Type: application/json' \
 -d '{"auth":{"identity":{"methods":["password"],"password":{"user":{"name":"<username>","domain":{"name":"<account_id>"},"password":"<password>"}}},"scope":{"project":{"name":"<project_name>","domain":{"name":"<account_id>"}}}}}' \
 'https://cloud.api.selcloud.ru/identity/v3/auth/tokens'

Specify:

  • <username> — service user name. You can view the name in the Control Panel: in the top menu, click IAM → the Service Users section (the section is available only to the Account Owner and a user with the iam.admin role);
  • <account_id> — account number. You can find it in the Control Panel in the upper-right corner;
  • <password> — service user password; you can view it when creating a user or change it to a new one;
  • <project_name> — project name.

Upon successful authorization, a response with code 201 Created will be returned in the following format:

HTTP/2 201
X-Subject-Token: token
  1. Find the token in the X-Subject-Token header.

Static token (X-Token)

For your information

An X-Token can only be issued to a Control Panel user.

The token is passed in a request in the X-Token. header.

A static token (static_token) provides full access to managing certain Selectel products on par with a username and password in the my.selectel.ru Control Panel. It does not allow managing OpenStack API objects.

The token lifespan is unlimited.

For APIs that do not support an IAM token for an account and an IAM token for a project, the static token is the only option:

Get a static token

  1. In the Control Panel, open the menu (account number) in the upper-right corner and select Profile.
  2. Go to the Access section → API Keys tab.
  3. Click Add Key.
  4. Enter the key name.
  5. Click Add.

API token support

APIAccount-scoped IAM tokenProject-scoped IAM tokenStatic token
IAM✓✗✗
Federations✓✗✗
Balance✓✗✓
Statistics✓✗✓
Reports✗✗✓
Transactions✗✗✓
Dedicated Servers✓✓✗
Cloud Platform Projects and Resources✓✓✗
Project Quotas and Limits✓✓✗
Project Quotas and Limits✓✓✗
Direct Public IP Addresses for Cloud Servers✗✓✗
Private DNS✗✓✗
Managed Databases✗✓✗
Managed Kubernetes✗✓✗
Container Registry✗✓✗
Secrets✗✓✗
Certificates✗✓✗
Let’s Encrypt® Certificates✗✓✗
Swift✗✓✗
Object Storage✗✓✗
Global Router✓✗✗
CDN✗✓✗
DNS Hosting (actual)✗✓✗
DNS Hosting (legacy)✓✗✓
Selectel Email Service✗✓✗
IP Address Management Service✗✗✓
Audit Logs✓✗✗
Cloud for 1C✗✓✗
Mobile Farm✓✓✗
Tickets✗✗✓
Attachments✗✗✓