---
title: "Request authentication"
description: "How to authenticate requests using IAM tokens or static tokens, and which tokens to use for different products"
---

import { CustomTable } from '@selectel/docux/components';

Depending on the [product](#supported-tokens-in-apis) or its resource, the following are used to work with Selectel product APIs and authenticate requests instead of a username and password:

* IAM tokens are issued to [service users](/access-control/user-types/#service-users). The token lifespan is 24 hours. IAM tokens are passed in the `X-Auth-Token` header and have different scopes:

  * [Account-scoped IAM tokens](#iam-token-account-scoped) (`iam_token_account_scoped`) — for managing resources linked to the account;
  * [Project-scoped IAM tokens](#iam-token-project-scoped) (`iam_token_project_scoped`) — for managing resources linked to the project;
* [static tokens](#static-token) (`static_token`) are issued to [control panel users](/access-control/user-types/#panel-users) and are used to manage resources linked to the account. Tokens have no expiration date. Static tokens are passed in the `X-Token`.

The address (URL) for requests can be found in the [Authentication](/api/urls/#authorization) subsection of the [List of URLs instructions](/api/urls/).

You can [restrict access](/account/limit-access-to-account/) to the API by addresses that include `https://api.selectel.ru`.

## Account-scoped IAM token (X-Auth-Token) \{#iam-token-account-scoped}

:::info

An account-scoped IAM token can only be issued to a [service user](/access-control/user-types/#service-users).

:::

The token is passed in the header `X-Auth-Token`.

An account-scoped IAM token (`iam_token_account_scoped`) grants access to manage most Selectel products and OpenStack API objects on par with a username and password in the [my.selectel.ru](https://my.selectel.ru/) control panel. It allows you to manage account resources.

The token lifespan is 24 hours.

The token allows you to manage:

* [users and roles (IAM](/api/users-and-roles/)) and [federations](/api/federations/);
* [balance](/api/balance/) and [usage statistics](/api/balance-statistics/);
* [dedicated servers](/api/dedicated/);
* OpenStack API objects (cloud servers, network volumes, and others) using the [cloud platform projects and resources](/api/cloud-projects-and-resources/), [project quotas and limits](/api/quota-management/) APIs, for details see the [OpenStack documentation](https://docs.openstack.org/2023.1/);
* [global router](/api/global-router/);
* [DNS hosting (legacy)](/api/dns-legacy/);
* [mobile farm](/api/mobile-farm/).

### Get an account-scoped IAM token \{#get-iam-token-account-scoped}

An account-scoped IAM token can be issued to [service users](/access-control/user-types/#service-users) who have a permission with the [scope](/access-control/access-management/#scopes) set to Account.

:::info

If you use Windows, replace single quotes (`''`) with double quotes (`""`) in requests. We also recommend using PowerShell for requests and not using CMD.

:::

1. Send the following request:

```bash
 curl -i -XPOST \
 -H 'Content-Type: application/json' \
 -d '{"auth":{"identity":{"methods":["password"],"password":{"user":{"name":"<username>","domain":{"name":"<account_id>"},"password":"<password>"}}},"scope":{"domain":{"name":"<account_id>"}}}}' \
 'https://cloud.api.selcloud.ru/identity/v3/auth/tokens'
```

Specify:

* `<username>` — service user name. You can find the name in the [control panel](https://my.selectel.ru/iam/service-users): in the top menu, click **IAM** → **Service Users** (the section is only available to the [Account Owner](/access-control/user-types/#account-owner) and a user with the [`iam.admin`](/access-control/role-reference/#iam-admin) role);
* `<account_id>` — account number. You can find it in the [control panel](https://my.selectel.ru/) in the upper right corner;
* `<password>` — service user password; you can view it when creating the user or [change it to a new one](/access-control/manage/edit-user-data-or-role/#change-service-user-password).

Upon successful authorization, a response with code `201 Created` will be returned in the format:

```
HTTP/2 201
X-Subject-Token: token
```

2. Find the token in the `X-Subject-Token` header.

## Project-scoped IAM token (X-Auth-Token) \{#iam-token-project-scoped}

:::info

A project-scoped IAM token can only be issued to a [service user](/access-control/user-types/).

:::

The token is passed in the header `X-Auth-Token`.

A project-scoped IAM token (`iam_token_project_scoped`) grants access to manage most Selectel products and OpenStack API objects on par with a username and password in the [my.selectel.ru](https://my.selectel.ru/) control panel. It allows you to manage project resources.

The token lifespan is 24 hours.

The token allows you to manage:

* [dedicated servers](/api/dedicated/);
* OpenStack API objects (cloud servers, network volumes, and others) using the [cloud platform projects and resources](/api/cloud-projects-and-resources/), [project quotas and limits](/api/quota-management/) APIs, for details see the [OpenStack documentation](https://docs.openstack.org/2023.1/);
* cloud platform — [direct public IP addresses](/api/cloud-public-network/), [private DNS](/api/private-dns/), [Managed Databases](/api/managed-databases/), [Managed Kubernetes](/api/managed-kubernetes/),  [Container Registry](/api/craas/),  secrets manager ([secrets](/api/secrets-manager/), [certificates](/api/certificates-manager/), [Let’s Encrypt® certificates](/api/lets-encrypt-certificates/));
* S3 ([Swift API](/api/object-storage-swift/) and [Object Storage API](/api/object-storage/));
* [DNS hosting](/api/dns-actual/);
* [Selectel email service](/api/email-service/);
* [Cloud for 1C](/api/1c-cloud/);
* [audit logs](/api/audit-logs/).

### Get a project-scoped IAM token \{#get-iam-token-project-scoped}

A project-scoped IAM token can be issued to [service users](/access-control/user-types/#service-users) who have a permission where:

* the [scope](/access-control/access-management/#scopes) is set to Account;
* or the [scope](/access-control/access-management/#scopes) is set to Projects and the required project is selected.

:::info

If you use Windows, replace single quotes (`''`) with double quotes (`""`) in requests. We also recommend using PowerShell for requests and not using CMD.

:::

1. Send the following request:

```bash
 curl -i -XPOST \
 -H 'Content-Type: application/json' \
 -d '{"auth":{"identity":{"methods":["password"],"password":{"user":{"name":"<username>","domain":{"name":"<account_id>"},"password":"<password>"}}},"scope":{"project":{"name":"<project_name>","domain":{"name":"<account_id>"}}}}}' \
 'https://cloud.api.selcloud.ru/identity/v3/auth/tokens'
```

Specify:

* `<username>` — service user name. You can find the name in the [control panel](https://my.selectel.ru/iam/service-users): in the top menu, click **IAM** → **Service Users** (the section is only available to the [Account Owner](/access-control/user-types/#account-owner) and a user with the [`iam.admin`](/access-control/role-reference/#iam-admin) role);
* `<account_id>` — account number. You can find it in the [control panel](https://my.selectel.ru/) in the upper right corner;
* `<password>` — service user password; you can view it when creating the user or [change it to a new one](/access-control/manage/edit-user-data-or-role/#change-service-user-password);
* `<project_name>` — project name.

Upon successful authorization, a response with code `201 Created` will be returned in the format:

```
HTTP/2 201
X-Subject-Token: token
```

2. Find the token in the `X-Subject-Token` header.

## Static token (X-Token) \{#static-token}

:::info

An X-Token can only be issued to a [control panel user](/access-control/user-types/#panel-users).

:::

The token is passed in the request header `X-Token`.

A static token (`static_token`) provides full access to managing certain Selectel products on par with a login and password in the [my.selectel.ru control panel](https://my.selectel.ru/). It does not allow you to manage OpenStack API objects.

The token lifespan is unlimited.

For APIs that do not support an [account-scoped IAM token](#iam-token-account-scoped) and a [project-scoped IAM token](#iam-token-project-scoped), a static token is the only option:

* [reports](/api/billing-reports/) and [transactions](/api/billing-transactions/);
* [IP address management service](/api/ip-addresses/);
* [tickets](/api/tickets/);
* [attachments](/api/tickets-attachments/).

### Get a static token \{#get-static-token}

1. In the [control panel](https://my.selectel.ru/profile/access/api-keys), in the upper right corner, open the menu (account number) and select **Profile**.
2. Go to the **Access** section → **API Keys**.
3. Click **Add Key**.
4. Enter the key name.
5. Click **Add**.

## API token support \{#supported-tokens-in-apis}

<CustomTable>
  <table>
    <thead>
      <tr>
        <th>API</th><th>Account-scoped IAM token</th><th>Project-scoped IAM token</th><th>Static token</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <td>[IAM](/api/users-and-roles/)</td><td>✓</td><td>✗</td><td colspan="2">✗</td>
      </tr>

      <tr>
        <td>[Federations](/api/federations/)</td><td>✓</td><td>✗</td><td>✗</td>
      </tr>

      <tr>
        <td>[Balance](/api/balance/)</td><td>✓</td><td>✗</td><td>✓</td>
      </tr>

      <tr>
        <td>[Statistics](/api/balance-statistics/)</td><td>✓</td><td>✗</td><td>✓</td>
      </tr>

      <tr>
        <td>[Reports](/api/billing-reports/)</td><td>✗</td><td>✗</td><td>✓</td>
      </tr>

      <tr>
        <td>[Transactions](/api/billing-transactions/)</td><td>✗</td><td>✗</td><td>✓</td>
      </tr>

      <tr>
        <td>[Dedicated Servers](/api/dedicated/)</td><td>✓</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Cloud platform projects and resources](/api/cloud-projects-and-resources/)</td><td>✓</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Project quotas and limits](/api/quota-management/)</td><td>✓</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Project quotas and limits](/api/quota-management/)</td><td>✓</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Direct public IP addresses of cloud servers](/api/cloud-public-network/)</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Private DNS](/api/private-dns/)</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Managed Databases](/api/managed-databases/)</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Managed Kubernetes](/api/managed-kubernetes/)</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Container Registry](/api/craas/)</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Secrets](/api/secrets-manager/)</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Certificates](/api/certificates-manager/)</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Let’s Encrypt® certificates](/api/lets-encrypt-certificates/)</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Swift](/api/object-storage-swift/)</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Object Storage](/api/object-storage/)</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Global Router](/api/global-router/)</td><td>✓</td><td>✗</td><td>✗</td>
      </tr>

      <tr>
        <td>[CDN](/api/cdn/)</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[DNS Hosting (actual](/api/dns-actual/))</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[DNS Hosting (legacy](/api/dns-legacy/))</td><td>✓</td><td>✗</td><td>✓</td>
      </tr>

      <tr>
        <td>[Selectel email service](/api/email-service/)</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[IP address management service](/api/ip-addresses/)</td><td>✗</td><td>✗</td><td>✓</td>
      </tr>

      <tr>
        <td>[Audit logs](/api/audit-logs/)</td><td>✓</td><td>✗</td><td>✗</td>
      </tr>

      <tr>
        <td>[Cloud for 1C](/api/1c-cloud/)</td><td>✗</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Mobile Farm](/api/mobile-farm/)</td><td>✓</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <td>[Tickets](/api/tickets/)</td><td>✗</td><td>✗</td><td>✓</td>
      </tr>

      <tr>
        <td>[Attachments](/api/tickets-attachments/)</td><td>✗</td><td>✗</td><td>✓</td>
      </tr>
    </tbody>
  </table>
</CustomTable>