# OpenStack API credentials (/docs/cloud-servers/openstack-api-credentials)



Servers.com allows you to manage your cloud servers and storage via OpenStack API. This article describes how to get started with OpenStack API and avoid exceeding OpenStack rate limits.

## Get Keystone credentials

Keystone is an OpenStack component responsible for authentication and authorization within the cloud platform. When using OpenStack API, you'll need to authorize via Keystone using its credentials. Servers.com uses Keystone v3.
To get credentials, go to **Cloud Servers** → **Instances** → **Show credentials**, select **Location**. Credentials are valid within a single cloud region.
You will need the following variables:

* API URL (e.g., `https://<keystone_host>:5000/v3`)
* User name (e.g., `OS_USERNAME`)
* Tenant name (e.g., `OS_PROJECT_NAME` / `OS_TENANT_NAME`)
* Password (e.g., `OS_PASSWORD`)
  Additional parameters that are not shown in the **Credentials** window but are required in Keystone:
* User domain (e.g., `OS_USER_DOMAIN_NAME`) — set the `default` value
* Project domain (e.g., `OS_PROJECT_DOMAIN_NAME`) — set the `default` value

## Get Keystone token

Authentication into Keystone is performed by getting a token that allows you to perform actions within OpenStack. A token is requested via an API request with the following structure:

* **Method:** `POST`
* **Endpoint:** `<OS_AUTH_URL>/auth/tokens`
* **Request headers:** `Content-Type: application/json`

**Request body:**

```json
{
  "auth": {
    "identity": {
      "methods": ["password"],
      "password": {
        "user": {
          "name": "<User name>",
          "domain": { "name": "default" },
          "password": "<Password>"
        }
      }
    },
    "scope": {
      "project": {
        "name": "<Tenant name>",
        "domain": { "name": "default" }
      }
    }
  }
}
```

There are several methods and tools you can use to get a token:

### cURL request

You can generate a token using cURL by making a POST request to the API endpoint obtained from the Keystone credentials:

```bash
curl -i -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "auth": {
      "identity": {
        "methods": ["password"],
        "password": {
          "user": {
            "name": "<User name>",
            "domain": { "name": "default" },
            "password": "<Password>"
          }
        }
      },
      "scope": {
        "project": {
          "name": "<Tenant name>",
          "domain": { "name": "default" }
        }
      }
    }
  }' \
  https://<keystone_host>:5000/v3/auth/tokens
```

Once you've made a successful request, you will get a response with a Fernet token in the **X-Subject-Token** header. You will also see its expiration time in the `expires_at` parameter.

### OpenStack SDK (Python)

OpenStack SDK automatically retrieves and renews a token. To set it up, follow these steps:

1. Install the library:

   ```bash
   pip install openstacksdk
   ```

2. Create a `clouds.yaml` file with the following content:
   ```yaml
   clouds:
     mycloud:
       auth:
         auth_url: https://<keystone_host>:5000/v3
         username: <User name>
         password: <Password>
         project_name: <Tenant name>
         user_domain_name: default
         project_domain_name: default
       region_name: <region_name>
       interface: public
   ```
   You can find the region name in the Customer Portal: **Cloud Storage** → **Access credentials** → **Shell variables** → `OS_REGION_NAME` value.

3. To create a connection with OpenStack, insert the following lines into your Python code:
   ```python
   from openstack import connection
   conn = connection.Connection(cloud='mycloud')
   ```

### OpenStack client (CLI)

To get a token via the OpenStack client:

1. In the Customer Portal, go to **Cloud Servers** → **Instances** → **Show credentials**, select **Location**.
2. Create the `openrc.sh` file and insert the variables from the previous step:
   ```bash
   export OS_AUTH_URL=https://auth.servers.%location_id%.cloud.servers.com:5000/v3/
   export OS_IMAGE_URL=https://images.servers.%location_id%.cloud.servers.com:9292
   export OS_TENANT_NAME=XXX
   export OS_USERNAME=YYY
   export OS_PASSWORD=ZZZ
   export OS_IDENTITY_API_VERSION=3
   export OS_DEFAULT_DOMAIN_NAME=default
   ```
3. Load the environment variables by running the following command in the terminal:
   ```bash
   source openrc.sh
   ```
4. Run any OpenStack command to verify it works, for example:
   ```bash
   openstack server list
   ```

## Limitations

Servers.com OpenStack platform has the following limitations:

* Servers.com OpenStack uses v3 Keystone — other versions are not supported
* A token is valid for 24 hours
* There are rate limits for Keystone authentication — refer to the [Rate limits](#rate-limits) section to optimize your request consumption

## Token recommendations

Follow these recommendations to ensure secure token usage:

* Store the token securely in a protected variable or configuration
* Do not log the token or store it in version control systems
* Applications should monitor token expiration and refresh it in advance
* Do not store passwords and tokens in plain text
* Use secure storage solutions (e.g., HashiCorp Vault, AWS Secrets Manager)

## Rate limits

For security reasons, Servers.com imposes limits on the number of authentication requests you can make in Keystone. Use the following recommendations to prevent request overuse:

* **Token reuse:** don't request a new token for every action — use one token until it expires
* **Token caching:**
  * In your code, start the token refresh process 1 hour before expiration
  * If a token is used every minute in parallel processes, requests made 5 minutes before expiration will reliably refresh the token
  * The optimal refresh interval is every 12 hours (half the token lifetime)
* **Limiting parallel authentication requests:** use a shared token in multi-threaded processes instead of a separate token for each thread
* **Handling rate-limiting errors:** implement an exponential backoff mechanism in case of a `429 Too Many Requests` error