Authentication

Every API, the CLI and Terraform work with a personal API token. One token is enough for every product; scopes decide what each token may do.

Creating a token

1. Sign in to the panel and open the API tokens page (Settings → API tokens).
2. Give it a name that says where it is used (for example ci-deploy or laptop).
3. Pick the scopes it needs from the tables below and, if useful, an expiry date and an IP allowlist.
4. Copy the token. It is shown only once, and Arianet does not keep a readable copy.

Sending the token

Send the token in the Authorization header of every request:

GET /cloud/v1/servers HTTP/1.1
Host: api.ariaservice.net
Authorization: Bearer <token>

curl -s https://api.ariaservice.net/cloud/v1/servers -H "Authorization: Bearer $ARIANET_TOKEN"

The CLI reads the token from arianet configure, the ARIANET_TOKEN environment variable or the --token flag; Terraform from the provider's token argument or the same variable.

Scopes

A token created without any scope has every permission of its owner. Limit each token to the scopes it needs. A request outside the token's scopes answers 403.

Arianet Cloud (/cloud/v1)

Scope	Allows
cloud:servers:read	Every GET: servers, volumes, networks, firewalls, IPs, load balancers, images, prices and actions
cloud:servers:write	Every change (POST, PUT, PATCH, DELETE)

The public price list (GET /cloud/v1/public/pricing) needs no token.

VPS (/api/v1)

Scope	Allows
regions:read	GET /regions
os:read	GET /os/datacenter/{id}
plans:read	GET /plans/...
servers:read / servers:write	Reading servers / creating, deleting, power, reinstalling, renaming and protection
ssh-keys:read / ssh-keys:write	SSH keys
firewalls:read / firewalls:write	Firewalls, their rules and attachments
balance:read	Balance and transactions
invoices:read	Invoices
tokens:read / tokens:write	Listing and revoking tokens

GET /auth/me and DELETE /auth/logout need no scope.

Regional VPS, hosting and dedicated servers

API	Read	Change
Regional VPS (/vps/v1)	vps:servers:read	vps:servers:write
Hosting (/hosting/v1)	hosting:accounts:read	hosting:accounts:write
Dedicated servers (/baremetal/v1)	baremetal:servers:read	baremetal:servers:write

SMS (/sms/v1)

Scope	Allows
sms:messages:read	Sent and received messages, batches, scheduled sends, prices and the report
sms:messages:write	Sending, cancelling scheduled sends, blocked numbers and the webhook
sms:lines:read	Sender lines
sms:templates:read / sms:templates:write	Reading / managing templates

Requesting a dedicated line (POST /lines) needs a token without scopes.

Restricting to IP addresses

A token can be limited to a list of source addresses or ranges. A request from any other address is refused with 403 even with a valid token (with code IP_NOT_ALLOWED on /api/v1). Always do this for servers and CI runners with fixed addresses.

Team members

When a member of an account's team creates a token, the token can never do more than that member: the account's IAM policies apply to every request as well. For example, managing reseller hosting needs hosting:reseller:manage, and changing a regional VPS's traffic setting needs vps:manage in IAM.

Managing and revoking tokens

• The API tokens page in the panel lists your tokens and revokes any of them. GET /api/v1/auth/tokens also returns each token's last use (last_used) and expiry (expires).
• With the VPS API: GET /api/v1/auth/tokens (scope tokens:read) and DELETE /api/v1/auth/tokens/{id} (scope tokens:write). DELETE /api/v1/auth/logout revokes the token the request was sent with.
• With the CLI: arianet auth tokens list, arianet auth tokens revoke <id>, arianet auth whoami and arianet auth logout.

Keeping tokens safe

• Never put a token in client-side code (browser, mobile app) or a repository; keep it in an environment variable or a secret store.
• Create a separate token with the fewest scopes for each application, server or pipeline, so you can revoke one without disturbing the others.
• Give CI tokens an expiry date and an IP allowlist, and rotate them regularly.
• If a token leaks, revoke it in the panel immediately.

In CI (the secret variable ARIANET_TOKEN is defined in the project settings):

.gitlab-ci.yml

deploy:
  image: alpine:3.20
  script:
    - apk add --no-cache curl
    - curl -fsS https://api.ariaservice.net/cloud/v1/servers -H "Authorization: Bearer $ARIANET_TOKEN"

.github/workflows/deploy.yml

jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      ARIANET_TOKEN: ${{ secrets.ARIANET_TOKEN }}
    steps:
      - run: curl -fsS https://api.ariaservice.net/cloud/v1/servers -H "Authorization: Bearer $ARIANET_TOKEN"

Authentication errors

HTTP	Means	What to do
401	No token, or it is invalid, expired or revoked	Check the Authorization: Bearer <token> header or create a new token
403	The token is valid but lacks a scope (insufficient_scope / INSUFFICIENT_SCOPE), the address is not allowed (IP_NOT_ALLOWED), or the account may not do this (forbidden, identity_needed)	Fix the token's scopes or IP list; for identity_needed, complete identity verification in the panel