OpenStack API Credentials

Servers.com allows you to manage your cloud servers and storage via OpenStack API. This article describes how to get started with OpenStack API and avoid exceeding OpenStack rate limits.

Get Keystone credentials

Keystone is an OpenStack component responsible for authentication and authorization within the cloud platform. When using OpenStack API, you'll need to authorize via Keystone using its credentials. Servers.com uses Keystone v3. To get credentials, go to Cloud Servers → Instances → Show credentials, select Location. Credentials are valid within a single cloud region. You will need the following variables:

API URL (e.g., https://<keystone_host>:5000/v3)
User name (e.g., OS_USERNAME)
Tenant name (e.g., OS_PROJECT_NAME / OS_TENANT_NAME)
Password (e.g., OS_PASSWORD) Additional parameters that are not shown in the Credentials window but are required in Keystone:
User domain (e.g., OS_USER_DOMAIN_NAME) — set the default value
Project domain (e.g., OS_PROJECT_DOMAIN_NAME) — set the default value

Get Keystone token

Authentication into Keystone is performed by getting a token that allows you to perform actions within OpenStack. A token is requested via an API request with the following structure:

Method: POST
Endpoint: <OS_AUTH_URL>/auth/tokens
Request headers: Content-Type: application/json

Request body:

{
  "auth": {
    "identity": {
      "methods": ["password"],
      "password": {
        "user": {
          "name": "<User name>",
          "domain": { "name": "default" },
          "password": "<Password>"
        }
      }
    },
    "scope": {
      "project": {
        "name": "<Tenant name>",
        "domain": { "name": "default" }
      }
    }
  }
}

There are several methods and tools you can use to get a token:

cURL request

You can generate a token using cURL by making a POST request to the API endpoint obtained from the Keystone credentials:

curl -i -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "auth": {
      "identity": {
        "methods": ["password"],
        "password": {
          "user": {
            "name": "<User name>",
            "domain": { "name": "default" },
            "password": "<Password>"
          }
        }
      },
      "scope": {
        "project": {
          "name": "<Tenant name>",
          "domain": { "name": "default" }
        }
      }
    }
  }' \
  https://<keystone_host>:5000/v3/auth/tokens

Once you've made a successful request, you will get a response with a Fernet token in the X-Subject-Token header. You will also see its expiration time in the expires_at parameter.

OpenStack SDK (Python)

OpenStack SDK automatically retrieves and renews a token. To set it up, follow these steps:

Install the library:
```
pip install openstacksdk
```

Create a clouds.yaml file with the following content:

clouds:
  mycloud:
    auth:
      auth_url: https://<keystone_host>:5000/v3
      username: <User name>
      password: <Password>
      project_name: <Tenant name>
      user_domain_name: default
      project_domain_name: default
    region_name: <region_name>
    interface: public

You can find the region name in the Customer Portal: Cloud Storage → Access credentials → Shell variables → OS_REGION_NAME value.

To create a connection with OpenStack, insert the following lines into your Python code:
```
from openstack import connection
conn = connection.Connection(cloud='mycloud')
```

OpenStack client (CLI)

To get a token via the OpenStack client:

In the Customer Portal, go to Cloud Servers → Instances → Show credentials, select Location.

Create the openrc.sh file and insert the variables from the previous step:

export OS_AUTH_URL=https://auth.servers.%location_id%.cloud.servers.com:5000/v3/
export OS_IMAGE_URL=https://images.servers.%location_id%.cloud.servers.com:9292
export OS_TENANT_NAME=XXX
export OS_USERNAME=YYY
export OS_PASSWORD=ZZZ
export OS_IDENTITY_API_VERSION=3
export OS_DEFAULT_DOMAIN_NAME=default

Load the environment variables by running the following command in the terminal:
```
source openrc.sh
```
Run any OpenStack command to verify it works, for example:
```
openstack server list
```

Limitations

Servers.com OpenStack platform has the following limitations:

Servers.com OpenStack uses v3 Keystone — other versions are not supported
A token is valid for 24 hours
There are rate limits for Keystone authentication — refer to the Rate limits section to optimize your request consumption

Token recommendations

Follow these recommendations to ensure secure token usage:

Store the token securely in a protected variable or configuration
Do not log the token or store it in version control systems
Applications should monitor token expiration and refresh it in advance
Do not store passwords and tokens in plain text
Use secure storage solutions (e.g., HashiCorp Vault, AWS Secrets Manager)

Rate limits

For security reasons, Servers.com imposes limits on the number of authentication requests you can make in Keystone. Use the following recommendations to prevent request overuse:

Token reuse: don't request a new token for every action — use one token until it expires
Token caching:
- In your code, start the token refresh process 1 hour before expiration
- If a token is used every minute in parallel processes, requests made 5 minutes before expiration will reliably refresh the token
- The optimal refresh interval is every 12 hours (half the token lifetime)
Limiting parallel authentication requests: use a shared token in multi-threaded processes instead of a separate token for each thread
Handling rate-limiting errors: implement an exponential backoff mechanism in case of a 429 Too Many Requests error