Help Center> API Gateway> API Reference (ME-Abu Dhabi Region)> Calling APIs> Authentication
Updated on 2023-05-09 GMT+08:00
View PDF

Authentication

Requests for calling an API can be authenticated using either of the following methods:

  • Token-based authentication: Requests are authenticated using a token.

    Call APIs using endpoints (see Endpoints) and tokens. This authentication mode is not supported for Object Storage Service (OBS), Data Ingestion Service (DIS), Natural Language Processing (NLP), Optical Character Recognition (OCR), or Image Recognition in the ME-Abu Dhabi-OP5 region.

  • AK/SK-based authentication: Requests are authenticated by encrypting the request body using an AK/SK pair. AK/SK-based authentication is recommended because it provides higher security than token-based authentication. Endpoints can be obtained from Endpoints.

    To call OBS, DIS, NLP, OCR, or Image Recognition APIs in the ME-Abu Dhabi-OP5 region, create a user and generate an AK/SK by referring to Creating a User and Generating an AK/SK, and then call the APIs using endpoints (https://docs.g42cloud.com/en-us/endpoint/index.html) through AK/SK authentication.

Token-based Authentication

The validity period of a token is 24 hours. When using a token for authentication, cache it to prevent frequently calling the IAM API used to obtain a user token.

A token specifies temporary permissions in a computer system. During API authentication using a token, the token is added to requests to get permissions for calling the API.

Making an API Request describes the process of calling the API used to create an API group (dedicated gateways). After a token is obtained, the X-Auth-Token header field must be added to requests to specify the token when calling other APIs. For example, if the token is ABCDEFJ...., X-Auth-Token: ABCDEFJ.... can be added to a request as follows:

POST https://{apig_endpoint}/v2/{project_id}/apigw/instances/{instance_id}/api-groups
Content-Type: application/json
X-Auth-Token: ABCDEFJ....

AK/SK-based Authentication

AK/SK-based authentication supports API requests with a body not larger than 12 MB. For API requests with a larger body, token-based authentication is recommended.

In AK/SK-based authentication, AK/SK is used to sign requests and the signature is then added to the requests for authentication.

  • AK: access key ID, which is a unique identifier used in conjunction with a secret access key to sign requests cryptographically.
  • SK: secret access key used in conjunction with an AK to sign requests cryptographically. It identifies a request sender and prevents the request from being modified.
In AK/SK-based authentication, you can use an AK/SK to sign requests based on the signature algorithm or use the signing SDK to sign requests. For details about how to sign requests and use the signature SDK, see the API Request Signing Guide.
  • The signing SDK is only used for signing requests and is different from the SDKs provided by services.
  • The local time on the client must be synchronized with the clock server to avoid a large offset in the value of the X-Sdk-Date request header.

    APIG checks the time format and compares the time with the time when APIG receives the request. If the time difference exceeds 15 minutes, APIG will reject the request.

Creating a User and Generating an AK/SK

  1. Log in to the APIG console.
  2. On the top navigation bar, select ME-Abu Dhabi-OP5.
  3. Choose Management & Deployment > Identity and Access Management.
  4. On the Users page, click Create User.

    1. Set basic user information.

      Enter user information, select Access key for Credential Type, enter a password, and click Next.

    2. (Optional) Add the user to a user group.

      Select a user group. If no user group is available, create one.

    3. Click Create.

  5. In the download access key dialog box, click OK.

    The user is created, and the credentials.csv file (AK/SK file) is downloaded.

Parent topic: Calling APIs