Skip to main content

API credentials

The API and the OpenStack CLI use the same Keystone application credential. It is scoped to one project and does not need a TOTP code, which makes it the right credential for scripts and CI.

Where to create it​

Create an application credential in the Vietnix Cloud console, in your account settings. Each credential has:

  • ID: the public identifier shown next to the credential name.
  • Secret: shown once at creation. Store it in a secret manager.
  • Expiration: optional; set one for temporary access.
  • Project: the credential acts only inside this project.
note

Step-by-step console instructions and screenshots will be added here.

Use it with the API​

Exchange the ID and secret for a Keystone token:

curl -ksD - -o /dev/null -X POST \
  -H 'Content-Type: application/json' \
  -d '{
    "auth": {
      "identity": {
        "methods": ["application_credential"],
        "application_credential": {
          "id": "<credential-id>",
          "secret": "<credential-secret>"
        }
      }
    }
  }' \
  https://api.vietnix.cloud/v3/auth/tokens

The token is in the X-Subject-Token response header. See Authentication for the full flow.

Use it with the CLI​

export OS_AUTH_TYPE=v3applicationcredential
export OS_AUTH_URL=https://api.vietnix.cloud/v3
export OS_IDENTITY_API_VERSION=3
export OS_APPLICATION_CREDENTIAL_ID="<credential-id>"
export OS_APPLICATION_CREDENTIAL_SECRET="<credential-secret>"

openstack token issue

The credential is already scoped, so OS_PROJECT_NAME is not required.

warning

The secret is shown once. Do not commit it, paste it into a ticket, or put it in a CI variable that is visible to forks. Rotate the credential when a laptop or runner is lost.