Skip to main content

Request authentication

Open in Markdown

Depending on the product or its resource, the following are used to work with Selectel product APIs and authenticate requests instead of a username and password:

  • IAM tokens are issued to service users. The token lifespan is 24 hours. IAM tokens are passed in the X-Auth-Token header and have different scopes:

  • static tokens (static_token) are issued to control panel users and are used to manage resources linked to the account. Tokens have no expiration date. Static tokens are passed in the X-Token.

The address (URL) for requests can be found in the Authentication subsection of the List of URLs instructions.

You can restrict access to the API by addresses that include https://api.selectel.ru.

Account-scoped IAM token (X-Auth-Token)

For your information

An account-scoped IAM token can only be issued to a service user.

The token is passed in the header X-Auth-Token.

An account-scoped IAM token (iam_token_account_scoped) grants access to manage most Selectel products and OpenStack API objects on par with a username and password in the my.selectel.ru control panel. It allows you to manage account resources.

The token lifespan is 24 hours.

The token allows you to manage:

Get an account-scoped IAM token

An account-scoped IAM token can be issued to service users who have a permission with the scope set to Account.

For your information

If you use Windows, replace single quotes ('') with double quotes ("") in requests. We also recommend using PowerShell for requests and not using CMD.

  1. Send the following request:
 curl -i -XPOST \
 -H 'Content-Type: application/json' \
 -d '{"auth":{"identity":{"methods":["password"],"password":{"user":{"name":"<username>","domain":{"name":"<account_id>"},"password":"<password>"}}},"scope":{"domain":{"name":"<account_id>"}}}}' \
 'https://cloud.api.selcloud.ru/identity/v3/auth/tokens'

Specify:

  • <username> — service user name. You can find the name in the control panel: in the top menu, click IAM → Service Users (the section is only available to the Account Owner and a user with the iam.admin role);
  • <account_id> — account number. You can find it in the control panel in the upper right corner;
  • <password> — service user password; you can view it when creating the user or change it to a new one.

Upon successful authorization, a response with code 201 Created will be returned in the format:

HTTP/2 201
X-Subject-Token: token
  1. Find the token in the X-Subject-Token header.

Project-scoped IAM token (X-Auth-Token)

For your information

A project-scoped IAM token can only be issued to a service user.

The token is passed in the header X-Auth-Token.

A project-scoped IAM token (iam_token_project_scoped) grants access to manage most Selectel products and OpenStack API objects on par with a username and password in the my.selectel.ru control panel. It allows you to manage project resources.

The token lifespan is 24 hours.

The token allows you to manage:

Get a project-scoped IAM token

A project-scoped IAM token can be issued to service users who have a permission where:

  • the scope is set to Account;
  • or the scope is set to Projects and the required project is selected.
For your information

If you use Windows, replace single quotes ('') with double quotes ("") in requests. We also recommend using PowerShell for requests and not using CMD.

  1. Send the following request:
 curl -i -XPOST \
 -H 'Content-Type: application/json' \
 -d '{"auth":{"identity":{"methods":["password"],"password":{"user":{"name":"<username>","domain":{"name":"<account_id>"},"password":"<password>"}}},"scope":{"project":{"name":"<project_name>","domain":{"name":"<account_id>"}}}}}' \
 'https://cloud.api.selcloud.ru/identity/v3/auth/tokens'

Specify:

  • <username> — service user name. You can find the name in the control panel: in the top menu, click IAM → Service Users (the section is only available to the Account Owner and a user with the iam.admin role);
  • <account_id> — account number. You can find it in the control panel in the upper right corner;
  • <password> — service user password; you can view it when creating the user or change it to a new one;
  • <project_name> — project name.

Upon successful authorization, a response with code 201 Created will be returned in the format:

HTTP/2 201
X-Subject-Token: token
  1. Find the token in the X-Subject-Token header.

Static token (X-Token)

For your information

An X-Token can only be issued to a control panel user.

The token is passed in the request header X-Token.

A static token (static_token) provides full access to managing certain Selectel products on par with a login and password in the my.selectel.ru control panel. It does not allow you to manage OpenStack API objects.

The token lifespan is unlimited.

For APIs that do not support an account-scoped IAM token and a project-scoped IAM token, a static token is the only option:

Get a static token

  1. In the control panel, in the upper right corner, open the menu (account number) and select Profile.
  2. Go to the Access section → API Keys.
  3. Click Add Key.
  4. Enter the key name.
  5. Click Add.

API token support

APIAccount-scoped IAM tokenProject-scoped IAM tokenStatic token
IAM✓✗✗
Federations✓✗✗
Balance✓✗✓
Statistics✓✗✓
Reports✗✗✓
Transactions✗✗✓
Dedicated Servers✓✓✗
Cloud platform projects and resources✓✓✗
Project quotas and limits✓✓✗
Project quotas and limits✓✓✗
Direct public IP addresses of cloud servers✗✓✗
Private DNS✗✓✗
Managed Databases✗✓✗
Managed Kubernetes✗✓✗
Container Registry✗✓✗
Secrets✗✓✗
Certificates✗✓✗
Let’s Encrypt® certificates✗✓✗
Swift✗✓✗
Object Storage✗✓✗
Global Router✓✗✗
CDN✗✓✗
DNS Hosting (actual)✗✓✗
DNS Hosting (legacy)✓✗✓
Selectel email service✗✓✗
IP address management service✗✗✓
Audit logs✓✗✗
Cloud for 1C✗✓✗
Mobile Farm✓✓✗
Tickets✗✗✓
Attachments✗✗✓