Authentication

Token-based Authentication

A token specifies temporary permissions in a computer system. During API authentication using a token, the token is added to a request to get permissions for calling the API.

• A token is valid for 24 hours. When using a token for authentication, cache it to avoid frequent calling.
• If your Huawei Cloud account has been upgraded to a Huawei ID, you cannot obtain a token. You are advised to create an IAM user and obtain the user token.

When calling the API to obtain a user token, you must set auth.scope in the request body to project.

You can log in to the console and choose My Credentials > API Credentials to obtain the values of username, domainname, and project name. password indicates the user password.

• Pseudocode

  POST https://iam.ap-southeast-2.myhuaweicloud.com/v3/auth/tokens //Uses obtaining the token in the AP-Bangkok region as an example.
  Content-Type: application/json
  { 
      "auth": { 
          "identity": { 
              "methods": [ 
                  "password" 
              ], 
              "password": { 
                  "user": { 
                      "name": "username", // IAM username
                      "password": "********", // Password
                      "domain": { 
                          "name": "domainname" // Account name
                      } 
                  } 
              } 
          }, 
          "scope": { 
              "project": { 
                  "name": "project name" //Replace project name with the actual project name, for example, ap-southeast-1.
              } 
          } 
      } 
  }

• Java

  package xxx; // Project path where the GetToken class is located
  
  import okhttp3.MediaType;
  import okhttp3.OkHttpClient;
  import okhttp3.Request;
  import okhttp3.RequestBody;
  import okhttp3.Response;
  
  public class GetToken {
      public static void main(String[] args) throws Exception {
          OkHttpClient client = new OkHttpClient().newBuilder().build();
          MediaType mediaType = MediaType.parse("application/json");
          String requestBody // Enter the correct account name, IAM username, and password.
              = "{\"auth\": {\"identity\": {\"methods\": [\"password\"],\"password\": {\"user\": {\"name\": \"********\",\"password\": \"********\",\"domain\": {\"name\": \"********\"}}}},\"scope\": {\"project\": {\"name\": \"ap-southeast-3\"}}}}";
          RequestBody body = RequestBody.create(requestBody, mediaType);
          Request request = new Request.Builder().url("https://iam.ap-southeast-3.myhuaweicloud.com/v3/auth/tokens")
              .method("POST", body)
              .addHeader("Content-Type", "application/json")
              .build();
          Response response = client.newCall(request).execute();
          System.out.println(response.header("X-Subject-Token"));
      }
  }

• Python

  import requests
  import json
  
  url = "https://iam.ap-southeast-3.myhuaweicloud.com/v3/auth/tokens"
  payload = json.dumps({
    "auth": {
      "identity": {
        "methods": [
          "password"
        ],
        "password": {
          "user": {
            "name": "username",
            "password": "********",
            "domain": {
              "name": "domainname"
            }
          }
        }
      },
      "scope": {
        "project": {
          "name": "projectname"
        }
      }
    }
  })
  headers = {
    'Content-Type': 'application/json'
  }
  
  response = requests.request("POST", url, headers=headers, data=payload)
  
  print(response.headers["X-Subject-Token"])

As shown in the following figure, x-subject-token in the response header is the desired user token. This token can then be used to authenticate the calling of OCR APIs.

Figure 1 Response header for obtaining a user token

AK/SK-based Authentication

AK/SK-based authentication supports API requests with a body less than or equal to 12 MB. For API requests with a larger body, perform token-based authentication.

In AK/SK-based authentication, AK/SK is used to sign requests and the signature is then added to the requests for authentication.

• AK: access key ID, which is a unique identifier used in conjunction with a secret access key to sign requests cryptographically.
• SK: secret access key used in conjunction with an AK to sign requests cryptographically. It identifies a request sender and prevents the request from being modified.

In AK/SK-based authentication, you can use an AK/SK to sign a request based on the signature algorithm or use a dedicated signature SDK to sign a request. For details about how to sign requests and use the signing SDK, see API Request Signing Guide.

If no AKs/SKs have been generated, log in to the console and choose My Credentials page in the upper right corner. On the page that is displayed, choose Access Keys in the navigation pane on the left, and click Create Access Key to create an AK/SK.

The signing SDK is only used for signing requests and is different from the SDKs provided by services.

For details about how to obtain the AK/SK, see Obtaining the AK/SK.