Authentication

You can use either of the following authentication methods to call APIs:

• Token authentication: Requests are authenticated using tokens.
• AK/SK authentication: Requests are encrypted using AK/SK pairs.

Token-based Authentication

• The validity period of a token is 24 hours. When using a token for authentication, cache it to prevent frequently calling the corresponding API for obtaining a user token.
• Ensure that the token is valid when you use it. Using a token that will soon expire may cause API calling failures.

A token is used to acquire temporary permissions. During API authentication using a token, the token is added to requests to get permissions for calling the API.

To obtain a token, call the API for obtaining a user token. For this service, the project-level token is required. You need to set auth.scope in the request body to project.

{ 
    "auth": { 
        "identity": { 
            "methods": [ 
                "password" 
            ], 
            "password": { 
                "user": { 
                    "name": "username", 
                    "password": "********", 
                    "domain": { 
                        "name": "domainname" 
                    } 
                } 
            } 
        }, 
        "scope": { 
            "project": { 
                "name": "xxxxxxxx" 
            } 
        } 
    } 
}

After a token is obtained, the X-Auth-Token header field must be added to the request header to specify the token when calling other APIs. For example, if the token is ABCDEFG...., add X-Auth-Token: ABCDEFG.... to a request header as follows:

POST https://iam.ap-southeast-1.myhuaweicloud.com/v3.0/OS-USER/usersContent-Type: application/json 
X-Auth-Token: ABCDEFG....

AK/SK Authentication

AK/SK-based authentication supports API requests with a body not larger than 12 MB. For API requests with a body larger than 12 MB, use token-based authentication.

AK/SK-based authentication is the process of signing a request with an AK/SK pair and adding the signature as a request header for authentication.

• AK: access key ID, which is a unique identifier used with a secret access key to sign requests cryptographically.
• SK: secret access key, which is used together with an AK to sign requests cryptographically. It identifies a request sender and prevents the request from being modified.

In AK/SK-based authentication, you can use an AK/SK pair to sign requests based on the signature algorithm or using a dedicated signing SDK. For details about how to sign requests and use the SDK, see AK/SK Signing and Authentication Guide.

The signing SDK is only used for signing requests and is different from the SDKs provided by services.