Security
October 10, 2017 By Deanna Brown 4 min read

Introducing IBM Cloud IAM Service IDs and API Keys

IBM Cloud Identity & Access Management (IAM) enables you to securely authenticate users and control access to all cloud resources consistently on the IBM Bluemix Platform.  Starting in September 2017, you can authenticate your applications or services by using service IDs.

What is a Service ID?

A service ID is an identity that can be used by an application or service. Imagine that a group of developers work on an application together. The application needs the ability to call APIs of several services in the IBM Bluemix Platform. None of the developers would wish to use their personal identities and API keys to access those services from the shared application as that would expose their personal credentials to their co-developers. The developers may also wish to use a credential that has access only to the services needed by the application rather than using a credential that authenticates them as a user who has broader access. Service IDs are ideal for this purpose. The developers can create a service ID and an API key that can be used to authenticate as the service ID. They can then grant the service ID access to only the services the application requires, and then use the service ID’s API key from the application to authenticate as the service ID.

Why use Service IDs?

  • Users can keep their personal credentials private

  • The service ID can be granted access only to the minimum set of services required; loss of the API key would not give access to everything the user has access to

  • Each application can have its own service ID and API key, allowing for easy rotation of one key without impacting other applications or users

  • If desired, a unique key can be used for each service so that an untrusted service cannot gain access to other resources

  • Since service IDs are not tied to a specific user, if a user leaves an organization and is deleted from the account, the service ID remains ensuring that your application or service stays up and running

How do I use Service IDs and API Keys?

To create a service ID, navigate to Manage->Security->Identity & Access. Then, select Service IDs from the left navigation menu.

 

Click Create. You’ll be prompted to give the Service ID a name and description. Choose values that will be meaningful to you and will help you identify what you use this service ID for when working in the UI.

Once you click Create, your service ID is displayed. 

In order for this service ID to have permissions to call APIs, you need to assign a policy to it. 

After you have assigned a policy to the service ID to give it permission to call APIs, you must create at least one API key for the service ID to enable an application to authenticate as this identity. In the Actions menu for the service ID, select Manage service ID. 

On the Manage Service ID page under the API keys section, click Create. 

You are prompted to give the API key a name and description. Again, choose a name and description that will help you remember what the key is used for. 

The key is generated and you can select to download it in a file or show it on the screen, which will allow you to cut and paste it into your application. You must save the key at this time because you cannot display it again. If you lose the key, you will need to delete that key and create a new one. 

The API key should be protected as you would protect a password. Anyone who obtains the API key can perform any action or access any resource that the service ID’s policies allow. It is recommended that API keys be rotated at regular intervals. To rotate your key, create a new API key, modify your application to use the new key, and then delete the old API key. It is possible for one service ID to have multiple active API keys, which enables you to rotate keys without disruption.

From the application, you can now use the POST /oidc/token call to exchange the API key for a temporary token that will be used for API calls. It is also possible to use the API key directly in API calls, but it is strongly recommended for better security that you use a token to reduce the chances of anyone learning your API key.

To learn more

Was this article helpful?
YesNo
Deanna Brown
Distinguished Engineer

More from Security
April 24, 2024

Data privacy examples

9 min read - An online retailer always gets users' explicit consent before sharing customer data with its partners. A navigation app anonymizes activity data before analyzing it for travel trends. A school asks parents to verify their identities before giving out student information. These are just some examples of how organizations support data privacy, the principle that people should have control of their personal data, including who can see it, who can collect it, and how it can be used. One cannot overstate…

April 24, 2024

How to prevent prompt injection attacks

8 min read - Large language models (LLMs) may be the biggest technological breakthrough of the decade. They are also vulnerable to prompt injections, a significant security flaw with no apparent fix. As generative AI applications become increasingly ingrained in enterprise IT environments, organizations must find ways to combat this pernicious cyberattack. While researchers have not yet found a way to completely prevent prompt injections, there are ways of mitigating the risk.  What are prompt injection attacks, and why are they a problem? Prompt…

April 15, 2024

Building the human firewall: Navigating behavioral change in security awareness and culture

4 min read - The latest findings of the IBM X-Force® Threat Intelligence Index report highlight a shift in the tactics of attackers. Rather than using traditional hacking methods, there has been a significant 71% surge in attacks where criminals are exploiting valid credentials to infiltrate systems. Info stealers have seen a staggering 266% increase in their utilization, emphasizing their role in acquiring these credentials. Their objective is straightforward: exploit the path of least resistance, often through unsuspecting employees, to obtain valid credentials. Organizations…

IBM Newsletters

 Get our newsletters and topic updates that deliver the latest thought leadership and insights on emerging trends.
Subscribe now More newsletters