Authentication

Updated on 2024-08-15 GMT+08:00

View PDF

You can use either of the following authentication methods when invoking an API:

Token authentication: Requests are authenticated using tokens. This method is relatively simple.
AK/SK authentication: Requests are encrypted using the access key ID (AK) and secret access key (SK). AK/SK authentication is recommended because it provides higher security than token authentication.

Token Authentication

NOTE:

The validity period of a token is 24 hours. If a token needs to be used, the system caches the token to avoid frequent calling. For details about token validity periods, see Obtaining a User Token Through Password Authentication

A token specifies certain permissions in a computer system. Authenticating using a token adds the token to the request header during API calling to obtain permissions to operate APIs through IAM.

In Constructing Requests, the process of calling the API for obtaining a user token is described as an example. After obtaining the customer token, add the X-Auth-Token header in a request to specify the token when calling other APIs. For example, if the token is ABCDEFJ...., add X-Auth-Token: ABCDEFJ.... in a request as follows:

Content-Type: application/json
X-Auth-Token: ABCDEFJ....

For details about how to obtain a customer token, see Obtaining a User Token.

AK/SK Authentication

NOTE:

AK/SK authentication supports API requests with a body size not larger than 12 MB. For API requests with a larger size, token authentication is recommended.

In AK/SK-based authentication, AK/SK is used to sign requests and the signature is then added to the requests for authentication.

AK: access key ID, which is a unique identifier used together with an SK to sign requests cryptographically.
SK: secret access key, which is used in conjunction with an AK to sign requests cryptographically. It identifies a request sender and prevents the request from being modified.

You can use AK/SK to sign requests based on the signature algorithm or use a dedicated signature SDK to sign the requests. For details about how to sign requests and use the signing SDK, see API Request Signing Guide.

NOTE:

The signing SDK is only used for signing requests and is different from the SDKs provided by services.

Parent topic: RESTful API

Previous topic: Constructing Requests

Next topic: Returned Values