Skip to main content

Authentication

The ImageFactory GraphQL API supports two authentication methods depending on your use case.

Endpoint: https://api.imagefactory.nordcloudapp.com/graphql

Bearer Token (Auth0)​

Bearer tokens are used for user-based access, including the ImageFactory Web UI and interactive API usage. Tokens are obtained through the Auth0 OpenID Connect (OIDC) flow.

Include the token in the Authorization header:

Authorization: Bearer {your_access_token}

Token Expiration​

Bearer tokens are short-lived. When a token expires, the API returns 401 Unauthorized. Your application should handle this by re-authenticating to obtain a fresh token.

Example​

curl -X POST https://api.imagefactory.nordcloudapp.com/graphql \
  -H "Authorization: Bearer YOUR_AUTH0_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ settings { regions } }"}'

API Key​

For programmatic access, CI/CD pipelines, and automated integrations, ImageFactory supports API Keys. This method is preferred for long-running processes where interactive login is not feasible.

API keys are created using a GraphQL mutation. The secret is only shown once in the response -- store it securely.

Include the key in the x-api-key header:

x-api-key: {your_api_key_secret}

An API key by itself does not grant any permissions. You must create a Role Binding that associates the API key with a specific Role within a customer context.

Example​

curl -X POST https://api.imagefactory.nordcloudapp.com/graphql \
  -H "x-api-key: YOUR_IMAGEFACTORY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ customers(input: { page: 1, limit: 10 }) { results { id name } } }"}'

Request Format​

All GraphQL requests use POST with a JSON body containing a query field (and optionally variables):

{
  "Authorization": "Bearer <token>"
}

or

{
  "x-api-key": "<secret>"
}

Rate Limiting​

ImageFactory implements rate limiting on API requests. Limits are applied per user or per API key. If you exceed the allowed number of requests, the API returns 429 Too Many Requests. Implement exponential backoff to handle this gracefully.

Security Best Practices​

  • Never commit secrets: Do not include API keys or tokens in source code or version control. Use environment variables or secret management services.
  • Rotate keys regularly: Periodically delete and recreate API keys to minimize the impact of a potential leak.
  • Principle of Least Privilege: Assign only the necessary roles to your API keys. Avoid roles with ANY action or ANY resource unless required.
  • Monitor Audit Logs: Review audit logs to track API usage and detect suspicious activity.