> This page is for Multi-Tenant, version v3.0 (default).
> For other versions, use one of these documentation indexes:
> - v3.0 (default): https://docs.nvidia.com/run-ai/multi-tenant/v3.0/llms.txt
> - v2.26: https://docs.nvidia.com/run-ai/multi-tenant/v2.26/llms.txt
> - v2.25: https://docs.nvidia.com/run-ai/multi-tenant/v2.25/llms.txt
> - v2.24: https://docs.nvidia.com/run-ai/multi-tenant/v2.24/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/run-ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/run-ai/_mcp/server.

# API Access Setup

To interact with the NVIDIA Run:ai platform programmatically, configure API access using access keys. This section outlines the steps to create a service account, generate tokens using the appropriate OAuth2 grant types, and authenticate securely with the platform APIs.

## Authenticate with Admin Credentials

Before registering a service account, authenticate using administrator credentials. Use the credentials configured via `global.management.user` and `global.management.password` as detailed in [Install the Control Plane](/run-ai/multi-tenant/documentation/installation-and-configuration/install/manual-helm/control-plane-setup/control-plane-installation).

Send a `POST` request to the `/api/v2/token` endpoint with `grant_type=password` to generate a token.

**Example request:**

```bash
curl -L 'https://console.<DOMAIN>/api/v2/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=password' \
--data-urlencode 'username=user@example.com' \
--data-urlencode 'password=yourPassword'
```

**Example response:**

```json
{
  "access_token": "<TOKEN>",
  "token_type": "Bearer",
  "expires_in": 3600
}
```

Use the returned `access_token` as a Bearer token in the `Authorization` header for subsequent API requests.

## Create a Service Account

After generating a token using the admin password, use it to register a service account. Service accounts contain a `clientId` and `clientSecret` that are used to authenticate future API requests via the `client_credentials` grant type.

Send a `POST` request to the `/api/v1/service-accounts` endpoint.

**Example request:**

```bash
curl -L 'https://console.<DOMAIN>/api/v1/service-accounts' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
-d '{
  "name": "service-account-123"
}'
```

**Example response:**

```json
{
  "id": "0eeaf222-e503-4f35-9d9c-c419816272e3",
  "name": "service-account-123",
  "clientSecret": "<CLIENT SECRET>",
  "clientId": "service-account-123"
}
```

## Generate a Token with Client Credentials

Use the `clientId` and `clientSecret` from your service account to generate an access token for authenticated API calls using the `client_credentials` grant type.

Send a `POST` request to the `/api/v2/token` endpoint with `grant_type=client_credentials`.

**Example request:**

```bash
curl -L 'https://console.<DOMAIN>/api/v2/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=<CLIENT ID>' \
--data-urlencode 'client_secret=<CLIENT SECRET>'
```

**Example response:**

```json
{
  "access_token": "<TOKEN>",
  "token_type": "Bearer",
  "expires_in": 3600
}
```

Use the `access_token` as a Bearer token in the `Authorization` header for all subsequent API requests.

## Create a Local User

Send a `POST` request to the `/api/v1/users` endpoint to create a local user.

**Example request:**

```bash
curl -L 'https://console.<DOMAIN>/api/v1/users' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
-d '{
  "email": "admin@hostorg.com",
  "resetPassword": false
}'
```

**Example response:**

```json
{
  "id": "0eeaf222-e503-4f35-9d9c-c419816272e3",
  "username": "admin@hostorg.com",
  "tempPassword": "<TEMP PASSWORD>"
}
```