Skip to main content

Request authentication

Depending on the product or its resource, the following are used to work with Selectel product APIs and authenticate requests instead of a username and password:

  • IAM tokens are issued to service users. The token lifespan is 24 hours. IAM tokens are passed in the X-Auth-Token header and have different scopes:

  • Static tokens (static_token) are issued to users with access to the control panel and are used to manage resources linked to the account. The token lifespan is unlimited. Static tokens are passed in the X-Token header.

The URL for your requests can be found in the list of URLs.

You can restrict access to the API by addresses that include https://api.selectel.ru.

Account-scoped IAM token (X-Auth-Token)

For your information

An account-scoped IAM token can only be issued to a service user.

The token is passed in the X-Auth-Token header.

An IAM token for an account (iam_token_account_scoped) provides access to managing most Selectel products and OpenStack API objects on par with a username and password in the my.selectel.ru Control Panel. It allows you to manage account resources.

The token lifespan is 24 hours.

The token allows you to manage:

Get an account-scoped IAM token

An account-scoped IAM token can be issued to service users who have a permission with the Account scope selected.

For your information

If you are using Windows, replace single quotes ('') with double quotes ("") in your requests. We also recommend using PowerShell for requests instead of CMD.

  1. Send the following request:
 curl -i -XPOST \
 -H 'Content-Type: application/json' \
 -d '{"auth":{"identity":{"methods":["password"],"password":{"user":{"name":"<username>","domain":{"name":"<account_id>"},"password":"<password>"}}},"scope":{"domain":{"name":"<account_id>"}}}}' \
 'https://cloud.api.selcloud.ru/identity/v3/auth/tokens'

Specify:

  • <username> is the service user name. You can view it in the control panel: in the top menu, click IAM → Service Users section (this section is only available to the Account Owner and users with the iam.admin role);
  • <account_id> is the account number. You can view it in the control panel in the top-right corner;
  • <password> is the service user password; you can view it when creating the user or change it to a new one.

Upon successful authorization, a response with code 201 Created will be returned in the following format:

HTTP/2 201
X-Subject-Token: token
  1. Check the token in the X-Subject-Token header.

Project-scoped IAM token (X-Auth-Token)

For your information

A project-scoped IAM token can only be issued to a service user.

The token is passed in the X-Auth-Token header.

An IAM token for a project (iam_token_project_scoped) provides access to managing most Selectel products and OpenStack API objects on par with a username and password in the my.selectel.ru Control Panel. It allows you to manage project resources.

The token lifespan is 24 hours.

The token allows you to manage:

Get a project-scoped IAM token

A project-scoped IAM token can be issued to service users who have a permission where:

  • the Account scope is selected;
  • or the Projects scope is selected and the required project is chosen.
For your information

If you are using Windows, replace single quotes ('') with double quotes ("") in your requests. We also recommend using PowerShell for requests instead of CMD.

  1. Send the following request:
 curl -i -XPOST \
 -H 'Content-Type: application/json' \
 -d '{"auth":{"identity":{"methods":["password"],"password":{"user":{"name":"<username>","domain":{"name":"<account_id>"},"password":"<password>"}}},"scope":{"project":{"name":"<project_name>","domain":{"name":"<account_id>"}}}}}' \
 'https://cloud.api.selcloud.ru/identity/v3/auth/tokens'

Specify:

  • <username> is the service user name. You can view it in the control panel: in the top menu, click IAM → Service Users section (this section is available only to the Account Owner and users with the iam.admin role);
  • <account_id> is the account number. You can view it in the control panel in the top-right corner;
  • <password> is the service user password; you can view it when creating the user or change it to a new one;
  • <project_name> is the project name.

Upon successful authorization, a response with code 201 Created will be returned in the following format:

HTTP/2 201
X-Subject-Token: token
  1. Check the token in the X-Subject-Token header.

Static token (X-Token)

For your information

An X-Token can only be issued to a user with access to the control panel.

The token is passed in the request in the X-Token header.

A static token (static_token) provides full access to managing some Selectel products on par with a username and password in the my.selectel.ru Control Panel. It does not allow managing OpenStack API objects.

The token lifespan is unlimited.

For APIs that do not support Account-scoped IAM token and Project-scoped IAM token, the static token is the only option for:

Get a static token

  1. In the control panel, open the menu in the top-right corner (account number) and select Profile.
  2. Go to Access → API Keys tab.
  3. Click Add Key.
  4. Enter the key name.
  5. Click Add.

API token support

APIAccount-scoped IAM tokenProject-scoped IAM tokenStatic token
IAM✓✗✗
Federations✓✗✗
Balance✓✗✓
Statistics✓✗✓
Reports✗✗✓
Transactions✗✗✓
Dedicated servers✓✓✗
Cloud platform projects and resources✓✓✗
Project quotas and limits✓✓✗
Project quotas and limits✓✓✗
Direct public IP addresses for cloud servers✗✓✗
Private DNS✗✓✗
Managed Databases✗✓✗
Managed Kubernetes✗✓✗
Container Registry✗✓✗
Secrets✗✓✗
Certificates✗✓✗
Let’s Encrypt® certificates✗✓✗
Swift✗✓✗
Object Storage✗✓✗
Global Router✓✗✗
CDN✗✓✗
DNS Hosting (actual)✗✓✗
DNS Hosting (legacy)✓✗✓
Selectel email service✗✓✗
IP address management service✗✗✓
Audit logs✓✗✗
Cloud for 1C✗✓✗
Mobile Farm✓✓✗
Tickets✗✗✓
Attachments✗✗✓