Skip to main content

Authentication

Every CMP API request must be authenticated with an API key and a secret key, supplied as HTTP headers. These credentials identify the account making the request and determine which resources it may access.

Obtaining API credentials​

API credentials are issued per user from the CMP web console:

  1. Sign in to the Cloud Management Portal.
  2. Open your account / profile settings.
  3. Locate the API Keys (or API Credentials) section.
  4. Generate a key pair. You will receive:
    • API Key (apikey) — a public identifier for your account.
    • Secret Key (secretkey) — a private secret used to authorize requests.
Keep your secret key private

The secret key grants full API access at your account's privilege level. Treat it like a password: never commit it to source control, embed it in client-side code, or share it. If a secret key is exposed, regenerate the key pair from the console immediately.

Supplying credentials​

Send both keys as HTTP request headers on every request:

HeaderTypeRequiredDescription
apikeystring✅ YesYour account's public API key.
secretkeystring✅ YesYour account's secret key.

Because apikey and secretkey are required on all endpoints, they are omitted from the per-endpoint parameter tables in the rest of this reference. Always include them as headers.

Example​

curl -X GET \
  "https://portal.your-domain.com/restapi/zone/zonelist" \
  -H "apikey: YOUR_API_KEY" \
  -H "secretkey: YOUR_SECRET_KEY"
note

Credentials are sent as headers, not as query-string or body parameters. Requests that place them elsewhere will be rejected with 401.

Authorization & permissions​

The privileges of the API call match the privileges of the account that owns the credentials. If the account is not permitted to view or modify a resource, the request is rejected with:

550 Permission Denied

See Error Codes for the full list of authentication and authorization responses.

Security best practices​

  • Rotate keys periodically and immediately after any suspected exposure.
  • Scope access by using an account with the minimum privileges required for the automation.
  • Transport security — always call the API over HTTPS; never over plain HTTP.
  • Server-side only — keep credentials on trusted servers, never in browsers or mobile apps.