Authentication

AK/SK-based Authentication

• AK/SK-based authentication supports API requests with a body not larger than 12 MB. For API requests with a larger body, use token-based authentication.

• You can use the AK/SK in a permanent or temporary access key. The X-Security-Token field must be configured if the AK/SK in a temporary access key is used, and the field value is security_token of the temporary access key.

In AK/SK-based authentication, the AK/SK is used to sign requests and the signature is then added to the requests for authentication.

• AK: access key ID. It is the unique identifier associated with the SK. The AK and SK are used together to sign requests cryptographically.
• SK: secret access key used in conjunction with an AK to sign requests cryptographically. It identifies a request sender and prevents the request from being modified.

In AK/SK-based authentication, you can use the AK/SK to sign requests based on the signature algorithm or use a dedicated signing SDK to sign requests. For details about how to sign requests and use the signing SDK, see AK/SK Signing and Authentication Guide.

The signing SDK is only used for signing requests and is different from the SDKs provided by services.

Authentication Using Tokens

• The validity period of a token is 24 hours. When using a token for authentication, cache it to prevent frequently calling the IAM API.
• Ensure that the token is valid while you use it. Using a token that will soon expire may cause API calling failures.

A token specifies certain permissions in a computer system. Authentication using a token adds the token to a request as its header during API calling to obtain permissions to operate APIs through IAM.

When calling the API to obtain a user token, you must set auth.scope in the request body to project.

{
	"auth": {
		"identity": {
			"methods": [
				"password"
			],
			"password": {
				"user": {
					"name": "username",    //Username
					"password": "********",    //Login password
					"domain": {
						"name": "domainname"    //Name of the account to which the user belongs
					}
				}
			}
		},
		"scope": {
			"project": {
				"name": "xxxxxxxx"    //Project name
			}
		}
	}
}

After a token is obtained, the X-Auth-Token header field must be added to requests to specify the token when calling other APIs. For example, if the token is ABCDEFJ...., X-Auth-Token: ABCDEFJ.... can be added to a request as follows:

POST https://iam.ap-southeast-1.myhuaweicloud.com/v3.0/OS-USER/users
Content-Type: application/json
X-Auth-Token: ABCDEFJ....