Authentication

Production

NIR API access is secured with OAuth 2.0. An OAuth client needs to be created to connect to the API. If you do not have a client ID and secret, then please contact software@apnic.net to request access.

The recommended authorisation grant is client credentials. This directly exchanges the client ID and secret for an access token. The first step is to find the token endpoint:

$ curl -s https://login.apnic.net/auth/realms/apnic/.well-known/openid-configuration \
    | jq -r '.token_endpoint'
https://login.apnic.net/auth/realms/apnic/protocol/openid-connect/token

Then, use the token endpoint to fetch a new access token;

$ curl -X POST 'https://login.apnic.net/auth/realms/apnic/protocol/openid-connect/token' \
    --header 'Content-Type: application/x-www-form-urlencoded' \
    --data-urlencode 'client_id=$id' \
    --data-urlencode 'client_secret=$secret' \
    --data-urlencode 'grant_type=client_credentials' \
    | jq -r '.access_token'

The access token can then be used to access the API. For example:

curl --header "Authorization: Bearer $access_token" https://nir-api.apnic.net/...

Note that access tokens are only valid for a short period of time (12 hours or less). This means that API clients must be configured with the client ID and secret, and be able to handle ‘token expired’ responses from the server by requesting a new access token using the process described above.

If your client secret is lost or compromised, please contact software@apnic.net.

Public testbed

The NIR API public testbed (https://registry-testbed.apnic.net/nir-api) uses static access tokens, so it works a little differently. Instead of exchanging client credentials for an access token, APNIC staff will provide you with an NIR-specific access token that does not expire. The token is then used in the same way as an access token is used in production. For example:

curl --header "Authorization: Bearer $access_token" https://registry-testbed.apnic.net/nir-api/...