API Access Setup

To interact with the NVIDIA Run:ai platform programmatically, configure API access using access keys. This section outlines the steps to create a service account, generate tokens using the appropriate OAuth2 grant types, and authenticate securely with the platform APIs.

Authenticate with Admin Credentials

Before registering a service account, authenticate using administrator credentials. Use the credentials configured via global.management.user and global.management.password as detailed in Install the Control Plane.

Send a POST request to the /api/v2/token endpoint with grant_type=password to generate a token.

Example request:

curl -L 'https://console.<DOMAIN>/api/v2/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=password' \
--data-urlencode 'username=user@example.com' \
--data-urlencode 'password=yourPassword'

Example response:

{
  "access_token": "<TOKEN>",
  "token_type": "Bearer",
  "expires_in": 3600
}

Use the returned access_token as a Bearer token in the Authorization header for subsequent API requests.

Create a Service Account

After generating a token using the admin password, use it to register a service account. Service accounts contain a clientId and clientSecret that are used to authenticate future API requests via the client_credentials grant type.

Send a POST request to the /api/v1/service-accounts endpoint.

Example request:

curl -L 'https://console.<DOMAIN>/api/v1/service-accounts' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
-d '{
  "name": "service-account-123"
}'

Example response:

{
  "id": "0eeaf222-e503-4f35-9d9c-c419816272e3",
  "name": "service-account-123",
  "clientSecret": "<CLIENT SECRET>",
  "clientId": "service-account-123"
}

Generate a Token with Client Credentials

Use the clientId and clientSecret from your service account to generate an access token for authenticated API calls using the client_credentials grant type.

Send a POST request to the /api/v2/token endpoint with grant_type=client_credentials.

Example request:

curl -L 'https://console.<DOMAIN>/api/v2/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=<CLIENT ID>' \
--data-urlencode 'client_secret=<CLIENT SECRET>'

Example response:

{
  "access_token": "<TOKEN>",
  "token_type": "Bearer",
  "expires_in": 3600
}

Use the access_token as a Bearer token in the Authorization header for all subsequent API requests.

Create a Local User

Send a POST request to the /api/v1/users endpoint to create a local user.

Example request:

curl -L 'https://console.<DOMAIN>/api/v1/users' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
-d '{
  "email": "admin@hostorg.com",
  "resetPassword": false
}'

Example response:

{
  "id": "0eeaf222-e503-4f35-9d9c-c419816272e3",
  "username": "admin@hostorg.com",
  "tempPassword": "<TEMP PASSWORD>"
}