API keys

Authentication & access tokens

The Openprovider REST API uses bearer-token authentication. Here’s how to obtain, use and secure your tokens.

How authentication works

Openprovider does not use static, long-lived API keys. Instead, you exchange your account credentials for a short-lived bearer token at the /auth/login endpoint, then send that token on every request.

1. Request a token

POST https://api.openprovider.eu/v1/auth/login
Content-Type: application/json

{
  "username": "you@example.com",
  "password": "your-password",
  "ip": "0.0.0.0"
}

2. Read the token from the response

{
  "code": 0,
  "data": {
    "token": "eyJ0eXAiOiJKV1QiLCJhbGciOi…",
    "reseller_id": 123456
  }
}

3. Authorize subsequent requests

GET https://api.openprovider.eu/v1/domains
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOi…

Tokens expire. Cache a token and reuse it for the duration of its validity instead of authenticating on every call. Repeated logins may be rate-limited.

Securing your credentials

PracticeWhy it matters
Store credentials in a secrets managerNever hard-code your username/password or tokens in source control.
Use IP whitelistingRestrict API access to known server IPs in the control panel to limit exposure.
Use a dedicated API userSeparate automation credentials from interactive logins so they can be rotated independently.
Rotate on suspicionChange the password (invalidating tokens) immediately if a credential may be compromised.
Transport over HTTPS onlyThe API rejects plaintext HTTP; always use TLS.

Managing access in the control panel

API access, IP whitelisting and credential management are configured from your Openprovider control panel under your reseller account settings.

API access is granted per contact person and is disabled by default. To turn it on, go to Account overview → Contact persons → either Add contact person or select an existing one → API tab → Enable API access. The credentials of that contact person are what you send to /auth/login.

For domain operations you might need to sign specific registry contracts before you can start. Check them under Account → Contracts.

Open control panel

Treat bearer tokens like passwords. Anyone holding a valid token can act on your account until it expires. Never log them, embed them in client-side code, or share them.