Updated on 2024-03-22 GMT+08:00

Authentication

Requests for calling an API can be authenticated using either of the following methods:

  • Token-based authentication: Requests are authenticated using a token.
  • AK/SK-based authentication: Requests are authenticated by encrypting the request body using an AK/SK pair.

Token-based Authentication

A token specifies temporary permissions in a computer system. During API authentication using a token, the token is added to a request to get permissions for calling the API.

  • A token is valid for 24 hours. When using a token for authentication, cache it to avoid frequent calling.
  • If your Huawei Cloud account has been upgraded to a Huawei ID, you cannot obtain a token. You are advised to create an IAM user and obtain the user token.

When calling the API to obtain a user token, you must set auth.scope in the request body to project.

You can log in to the console and choose My Credentials > API Credentials to obtain the values of username, domainname, and project name. password indicates the user password.

  • Pseudocode
    POST https://iam.ap-southeast-2.myhuaweicloud.com/v3/auth/tokens //Uses obtaining the token in the AP-Bangkok region as an example.
    Content-Type: application/json
    { 
        "auth": { 
            "identity": { 
                "methods": [ 
                    "password" 
                ], 
                "password": { 
                    "user": { 
                        "name": "username", // IAM username
                        "password": "********", // Password
                        "domain": { 
                            "name": "domainname" // Account name
                        } 
                    } 
                } 
            }, 
            "scope": { 
                "project": { 
                    "name": "project name" //Replace project name with the actual project name, for example, ap-southeast-1.
                } 
            } 
        } 
    }
  • Java
    package xxx; // Project path where the GetToken class is located
    
    import okhttp3.MediaType;
    import okhttp3.OkHttpClient;
    import okhttp3.Request;
    import okhttp3.RequestBody;
    import okhttp3.Response;
    
    public class GetToken {
        public static void main(String[] args) throws Exception {
            OkHttpClient client = new OkHttpClient().newBuilder().build();
            MediaType mediaType = MediaType.parse("application/json");
            String requestBody // Enter the correct account name, IAM username, and password.
                = "{\"auth\": {\"identity\": {\"methods\": [\"password\"],\"password\": {\"user\": {\"name\": \"********\",\"password\": \"********\",\"domain\": {\"name\": \"********\"}}}},\"scope\": {\"project\": {\"name\": \"ap-southeast-3\"}}}}";
            RequestBody body = RequestBody.create(requestBody, mediaType);
            Request request = new Request.Builder().url("https://iam.ap-southeast-3.myhuaweicloud.com/v3/auth/tokens")
                .method("POST", body)
                .addHeader("Content-Type", "application/json")
                .build();
            Response response = client.newCall(request).execute();
            System.out.println(response.header("X-Subject-Token"));
        }
    }
  • Python
    import requests
    import json
    
    url = "https://iam.ap-southeast-3.myhuaweicloud.com/v3/auth/tokens"
    payload = json.dumps({
      "auth": {
        "identity": {
          "methods": [
            "password"
          ],
          "password": {
            "user": {
              "name": "username",
              "password": "********",
              "domain": {
                "name": "domainname"
              }
            }
          }
        },
        "scope": {
          "project": {
            "name": "projectname"
          }
        }
      }
    })
    headers = {
      'Content-Type': 'application/json'
    }
    
    response = requests.request("POST", url, headers=headers, data=payload)
    
    print(response.headers["X-Subject-Token"])

As shown in the following figure, x-subject-token in the response header is the desired user token. This token can then be used to authenticate the calling of OCR APIs.

Figure 1 Response header for obtaining a user token

AK/SK-based Authentication

AK/SK-based authentication supports API requests with a body less than or equal to 12 MB. For API requests with a larger body, perform token-based authentication.

In AK/SK-based authentication, AK/SK is used to sign requests and the signature is then added to the requests for authentication.

  • AK: access key ID, which is a unique identifier used in conjunction with a secret access key to sign requests cryptographically.
  • SK: secret access key used in conjunction with an AK to sign requests cryptographically. It identifies a request sender and prevents the request from being modified.

In AK/SK-based authentication, you can use an AK/SK to sign a request based on the signature algorithm or use a dedicated signature SDK to sign a request. For details about how to sign requests and use the signing SDK, see API Request Signing Guide.

If no AKs/SKs have been generated, log in to the console and choose My Credentials page in the upper right corner. On the page that is displayed, choose Access Keys in the navigation pane on the left, and click Create Access Key to create an AK/SK.

The signing SDK is only used for signing requests and is different from the SDKs provided by services.

For details about how to obtain the AK/SK, see Obtaining the AK/SK.