---
title: "Cloud Platform API v2 authentication"
date: "2024-02-14T06:18:38+00:00"
summary: "Learn how to authenticate Cloud Platform API v2 calls using OAuth 2.0. Generate tokens, make API requests, and handle Federated Authentication."
image:
type: "page"
url: "/acquia-cloud-platform/cloud-platform-api-v2-authentication"
id: "14a4b5e8-e5c3-4202-b29d-2aa7a40299d6"
---

All Cloud Platform API v2 calls require authentication to work. The information on this page is applicable only for Cloud Platform API version 2.

Important

HMAC authentication is deprecated and will be removed from Cloud Platform API version 2 on July 1, 2020.

Generating an API token
-----------------------

For correct implementation of OAuth2 for API requests, your configuration and permissions must be correctly configured in your control panel. If refresh tokens are required, follow the correct procedure and obtain them. For more information, visit [Cloud Platform API documentation](https://cloudapi-docs.acquia.com/).

To generate an API token for authenticating with the Cloud Platform API v2:

1.  [Sign in to the Cloud Platform user interface](/node/55875) using your email address and Acquia password.
2.  Click your user avatar in the upper right corner, and then click **Account Settings**.
    
    ![cloud-platform_account-settings-option.png](https://acquia.widen.net/content/2b48398e-5a05-4cb2-a924-a3906a8cc1b5/web/cloud-platform_account-settings-option.png?w=480&itok=QaHqvvcy)
    
3.  On the Profile page, click **API Tokens**.
4.  Provide a human-readable label for your API token, and click **Create Token**.
    
    Cloud Platform will generate an **API Key** and **API secret** for you.
    
5.  Record a copy of your **API Key** and **API secret**, as you can’t retrieve them after closing your browser tab.

You can remove a token at any time by clicking **Remove** next to the token you want to remove.

Authenticating in Cloud Platform API RESTful interface calls
------------------------------------------------------------

Each Cloud Platform API call authenticates requests with [OAuth 2.0 client credentials](https://oauth.net/2/grant-types/client-credentials/), and requires the information provided when [generating an API token](#cloud-generate-api-token).

*   **Access Token URL**: `https://accounts.acquia.com/api/auth/oauth/token`
*   **Client ID**: The **API Key** provided to you when [generating an API token](#cloud-generate-api-token)
*   **Secret**: The **API Secret** provided to you when [generating an API token](#cloud-generate-api-token)

The **Client ID** and **Secret** are exchanged for a [bearer access token](https://oauth.net/2/bearer-tokens/), which authenticates calls to the Cloud Platform API.

Note

*   The access token expires in 300 seconds or 5 minutes after you generate it. Therefore, you must regenerate it before the expiration date.
*   You must not include unauthorized ports like 443 in your endpoint calls unless specified otherwise.
*   You can increase the OAuth token timeout from the default setting of 10 seconds to 20-25 seconds to prevent frequent timeouts.
*   Run `composer require league/oauth2-client`, and download an [`example authentication script`](https://docs.acquia.com/downloadable-resources?cid=1e3a0#section-api-v2-authphp).

**Generating tokens with a curl request** 

If you generate an API token with a `curl` request, instead of the Cloud Platform user interface, Acquia recommends passing the data with a `--data-urlencode` parameter instead of a `--data` parameter to prevent incorrect encoding of non-alphanumeric characters, similar to the following example:

`curl https://accounts.acquia.com/api/auth/oauth/token --data-urlencode "client_id=API_KEY" --data-urlencode "client_secret=API_SECRET" --data-urlencode "grant_type=client_credentials"`

Making API calls in Federated Authentication-enabled organization
-----------------------------------------------------------------

If your organization uses Federated Authentication, you must use OAuth 2.0 and request the `organization:uuid` scope while generating the API token. The `uuid` is the UUID of the organization’s resources for which you want access. If you do not do this, the system displays one of the following error messages when making an API request:

*       additional_authentication_required
    
*       This resource requires additional authentication.
    

Here is an example `curl` request that includes the organization scope:

    curl \
    --data-urlencode 'client_id=API TOKEN KEY HERE' \
    --data-urlencode 'client_secret=API TOKEN SECRET HERE' \
    --data-urlencode 'grant_type=client_credentials' \
    --data-urlencode 'scope=organization:23NNe327-NAAA-11e3-NNNN-1231NNNNa02c' \
    -X POST \
    'https://accounts.acquia.com/api/auth/oauth/token'