How to Authenticate to the API

The following document explains how to authenticate with NVIDIA Run:ai APIs.

NVIDIA Run:ai APIs are accessed using bearer tokens. A token can be obtained in several ways:

• When logging into the NVIDIA Run:ai user interface, you enter an email and password (or authenticated via single sign-on) which are used to obtain a token.

• When using the NVIDIA Run:ai command-line, you use a Kubernetes profile and are authenticated by pre-running runai login (or oc login with OpenShift). The command attaches a token to the profile and allows you access to NVIDIA Run:ai functionality.

• When using NVIDIA Run:ai APIs, you need to create an Application through the NVIDIA Run:ai user interface. The Application is created with specific roles and contains a secret. Using the secret you can obtain a token and use it within subsequent API calls.

Create a Client Application

• Open the NVIDIA Run:ai User Interface.

• Go to Settings & Tools, Application and create a new Application.

• Copy the <APPLICATION> and <SECRET KEY> to be used below

Access Rules for the Application

For you API requests to be accepted, you will need to set access rules for the application. To assign roles to an application, see Create or Delete rules.

Use the Roles table to assign the correct roles to the application.

Request an API Tken

Use the client credentials created to get a temporary token to access NVIDIA Run:ai as follows.

Example Command to Get an API Token

Replace <COMPANY-URL> below with:

• For SaaS installations, use <tenant-name>.run.ai

• For self-hosted use the NVIDIA Run:ai user interface URL.

cURL

    curl  -X POST \
      'https://<COMPANY-URL>/api/v1/token' \
      --header 'Accept: */*' \
      --header 'Content-Type: application/json' \
      --data-raw '{
      "grantType":"app_token",
      "AppId":"<APPLICATION NAME>",
      "AppSecret" : "<SECRET KEY>"
    }'

Python

Response

The API response will look as follows:

{
  "accessToken": "<TOKEN>", 
}

To call NVIDIA Run:ai REST APIs, the application must pass the retrieved accessToken as a Bearer token in the Authorization header of your HTTP request.