Generate IAM v2 Tokens

Last updated
Save as PDF

This topic outlines how to obtain an IAM v2 token required for authenticating Skyhigh Security SSE API requests.

Prerequisites

Before you generate an access token, you must obtain a Registration Token from Skyhigh Security Support.

Contact Support. Request a client type appropriate for the API you plan to use (the specific client type is usually found in the API documentation).
Provide Tenant ID. Provide your BPS Tenant ID to the Support representative.
Receive Registration Token. Skyhigh Support will securely provide a Registration Token.

NOTE:

This token is for one-time use and valid only for initial credential generation.
Redeem it within 24 hours. If expired, contact Skyhigh Support to request a new one.

Step 1: Redeem Registration Token for Client Credentials

Skyhigh Support does not provide Client Secrets directly. You must exchange your Registration Token for a Client ID and Client Secret.

Endpoint: https://iam.skyhigh.cloud/iam/v2/registration
Method: POST
Header: Authorization: Bearer <Registration_Token>

Sample Redemption Request (cURL)

curl -X POST "https://iam.skyhigh.cloud/iam/v2/registration" \
-d "registration_token: YOUR_REGISTRATION_TOKEN"

Sample Response

Upon execution, the system returns your permanent credentials.

IMPORTANT: Save the client_secret immediately. It is not stored in plain text by Skyhigh and cannot be recovered if lost. In this case, you must request a new registration token.

{
 "client_id": "pb-xxxxxxxx-xxxx-xxxx",
 "client_secret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

NOTE: Unused credentials expire after 90 days. Each successful use of the credentials resets this timer.

Step 2: Generate an IAM v2 Access Token

Once you have your client credentials, use the IAM token endpoint to exchange them for a Bearer token.

Endpoint: https://iam.skyhigh.cloud/iam/v2/token
Method: POST
Headers:

Content-Type: application/x-www-form-urlencoded
Authorization: Basic <Base64_encoded_credentials>

NOTE: The credentials should be in the format client_id:client_secret before Base64 encoding.

Request Body (Parameters)

Parameter	Value	Description
grant_type	client_credentials	Specifies the grant type for service-to-service authentication
scope	testservice	The required scope will be specified in the API documentation
audience	IAM AuthZ	The required audience will be specified in the API documentation

Sample Request (cURL)

curl -X POST "https://iam.skyhigh.cloud/iam/v2/token" \
-H "Authorization: Basic <Base64_encoded_client_id:client_secret>" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials&scope=testservice&audience=IAM AuthZ"

Sample Response

On execution, the system returns a JSON object containing the access_token.

{
  "token_type": "Bearer",
  "expires_in": 600,
  "access_token": "eyJ0eXAiOiJKV1Qi..."
}

Step 3: Use the Token in API Requests

Include the access_token in the Authorization header of your API calls.

Header Format:Authorization: Bearer <access_token>

Example for Retrieve Evidence API:

GET /evidence/v1/evidence?tenant=&ObjectID=
Authorization: Bearer eyJ0eXAiOiJKV1Qi...

Troubleshoot API Authentication

Case 1: Credentials have expired

Issue. IAM AuthZ returns 401 Unauthorized when trying to generate a token
Root Cause. Client credentials (ID/Secret) expire if not used for 90 days.
Resolution. Contact Skyhigh Support to re-issue the client credentials with a registration token.

Case 2: Token has expired

Issue. API returns 401 Unauthorized after a period of successful calls.
Root Cause. IAM v2 access tokens are short-lived (typically 600 seconds/10 minutes).
Resolution. Implement logic in your script/application to create a new token using the POST /iam/v2/token call if the existing token is expired.