Get a token
Get an Identity token with the OpenStack CLI or the Identity API, and send it with an API request.
This guide gets a token from Identity and uses it to call an API. You only need to do this for
direct API calls: the openstack CLI and the OpenStack SDKs get tokens for you.
Before you begin
You need either the openstack CLI signed in, or an
application credential for calls with curl.
1. Get the token
The CLI prints a token for the project it is signed in to. Keep only the token in a variable:
export TOKEN=$(openstack token issue -f value -c id)To see which project the token is for and when it expires, show those fields instead:
openstack token issue -c expires -c project_id -c user_id+------------+----------------------------------+
| Field | Value |
+------------+----------------------------------+
| expires | 2026-10-07T23:41:09+0000 |
| project_id | a6f1c2d93b8e4f07b5d4e2c1a9f8e7d6 |
| user_id | 4c8e2f1a9b7d4e6f8a3c5b1d7e9f2a4c |
+------------+----------------------------------+2. Send it with a request
Put the token in the X-Auth-Token header. This request asks Identity which projects you can
access, which works with any valid token:
curl https://auth.vexxhost.net/v3/auth/projects \
--header "X-Auth-Token: $TOKEN"{
"links": {
"self": "https://auth.vexxhost.net/v3/auth/projects",
"previous": null,
"next": null
},
"projects": [
{
"id": "a6f1c2d93b8e4f07b5d4e2c1a9f8e7d6",
"name": "acme-production",
"description": "Production workloads",
"domain_id": "default",
"enabled": true,
"is_domain": false,
"parent_id": "default",
"links": {
"self": "https://auth.vexxhost.net/v3/projects/a6f1c2d93b8e4f07b5d4e2c1a9f8e7d6"
}
}
]
}Other services take the token the same way. Find their endpoints in the service catalog.
Verify
A request with a valid token gets a 200 OK response. A 401 Unauthorized response means the
token is missing or has expired. Get a new one.
Next steps
- Learn how tokens work in Authentication.
- Make API requests to other services with the token.