Authentication

Authorization: Bearer <token>

• The token belongs to an API key of the Organization, created on the Applications page. See Managing Applications.
• The token is read from the Authorization header only.
• A token starts with ncp_ followed by the public ID of its API key.
• A missing, malformed, unknown or expired token, or a token of a disabled or deleted API key, returns 401 with the errorCode UNAUTHORIZED and the header WWW-Authenticate: Bearer.
• An API key holds API permissions: None, Read or Write per API. Write includes Read. The permissions of a Service API are set for all contexts of the service, including new ones, or for selected contexts. Each operation names the permission it needs; see API permissions. A missing permission returns 403 with the errorCode FORBIDDEN and requiredPermission; see A missing permission.
• An API key works only with the Platform API. It cannot sign in to the Admin Dashboard, and an Admin Dashboard session cannot call the Platform API.

IP access list

With Require IP access list on, the default, an API key accepts requests only from the addresses on its own IP access list:

IP access list	Require IP access list on	Require IP access list off
Has entries	Only the listed addresses	Only the listed addresses
Empty	No requests	Any address

A refused request returns 403 with the errorCode IP_ADDRESS_NOT_ON_ACCESS_LIST. The detail names the address the request came from. See IP access list.

403

{
  "type": "about:blank",
  "title": "Forbidden",
  "status": 403,
  "detail": "The request comes from 203.0.113.10, which is not on the API key's access list.",
  "errorCode": "IP_ADDRESS_NOT_ON_ACCESS_LIST",
  "requestId": "c41e7b20-6a3d-4f95-8e17-2b9d0a5c6f38"
}

Audit Log

Changes made with an API key are recorded in the Audit Log with the API key as the User: apikey: followed by its public ID.