Help Center/ API Gateway/ API Reference (Paris Region)/ Calling APIs/ Authentication
Updated on 2022-04-14 GMT+08:00
View PDF
Share

Authentication

Requests for calling an API can be authenticated using either of the following methods:

  • Token-based authentication: Requests are authenticated using a token.

    Call APIs using endpoints (see Endpoints) and tokens. This authentication mode is not supported for Object Storage Service (OBS) and Data Ingestion Service (DIS) in the EU-Paris region.

  • AK/SK-based authentication: Requests are authenticated by encrypting the request body using an AK/SK pair. AK/SK-based authentication is recommended because it provides higher security than token-based authentication. Endpoints can be obtained from Endpoints.

    To call OBS and DIS APIs in the EU-Paris region, create a user and generate an AK/SK by referring to Creating a User and Generating an AK/SK, and then call the APIs using endpoints (https://docs.prod-cloud-ocb.orange-business.com/en-us/endpoint/index.html#) through AK/SK authentication.

Token-based Authentication

The validity period of a token is 24 hours. When using a token for authentication, cache it to prevent frequently calling the IAM API used to obtain a user token.

A token specifies temporary permissions in a computer system. During API authentication using a token, the token is added to requests to get permissions for calling the API.

In Making an API Request, the process of calling the API used to obtain a user token is described. After a token is obtained, the X-Auth-Token header field must be added to requests to specify the token when calling other APIs. For example, if the token is ABCDEFJ...., X-Auth-Token: ABCDEFJ.... can be added to a request as follows:

POST https://{{endpoint}}/v3/auth/projects
Content-Type: application/json
X-Auth-Token: ABCDEFJ....

AK/SK-based Authentication

AK/SK-based authentication supports API requests with a body not larger than 12 MB. For API requests with a larger body, token-based authentication is recommended.

In AK/SK-based authentication, AK/SK is used to sign requests and the signature is then added to the requests for authentication.

  • AK: access key ID, which is a unique identifier used in conjunction with a secret access key to sign requests cryptographically.
  • SK: secret access key used in conjunction with an AK to sign requests cryptographically. It identifies a request sender and prevents the request from being modified.
In AK/SK-based authentication, you can use an AK/SK to sign requests based on the signature algorithm or use the signing SDK to sign requests. For details about how to sign requests and use the signature SDK, see API Request Signing Guide.
  • The signing SDK is only used for signing requests and is different from the SDKs provided by services.
  • The local time on the client must be synchronized with the clock server to avoid a large offset in the value of the X-Sdk-Date request header.

    API Gateway checks the time format and compares the time with the time when API Gateway receives the request. If the time difference exceeds 15 minutes, API Gateway will reject the request.

Creating a User and Generating an AK/SK

  1. Log in to the API Gateway console.
  2. On the top navigation bar, select EU-Paris.
  3. Choose Management & Deployment > Identity and Access Management.
  4. On the Users page, click Create User.

    Enter a username, select Access key for Credential Type, and click OK.

  5. In the download access key dialog box, click OK.

    The user is created, and the credentials.csv file (AK/SK file) is downloaded.

Parent topic: Calling APIs