Retrieving IAM access tokens

Get started with the IBM Analytics Engine API by authenticating your requests to the service with an IBM Cloud® Identity and Access Management (IAM) access token.

An access token is a temporary credential that expires after 1 hour. After the acquired token expires, you must generate a new token to continue calling the IBM Analytics Engine API. To maintain access to the service, regenerate the access token for your API key on a regular basis.

The recommended method to retrieve a token programmatically is to create an API key for your IBM Cloud® ID and then use the IAM token API to exchange that key for a token.

You can create a token in two ways:

By using the IBM Cloud REST API
By using the IBM Cloud® CLI

Create a token using the IBM Cloud REST API

To create a token in IBM Cloud:

Sign in to IBM Cloud and select Manage>Security>Platform API Keys.
Create an API key for your own personal identity, copy the key value, and save it in a secure place. After you leave the page, you will no longer be able to access this value.

Use the API key you created with the IAM identity token API to generate an IAM token. For example:

curl -X POST \
'https://iam.cloud.ibm.com/identity/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=urn:ibm:params:oauth:grant-type:apikey&apikey=<your iam api key>'

For details on the API syntax, see IAM identity token API.

This is a sample of what is returned:

{
   "access_token": "eyJraWQiOiIyMDE3MDgwOS0wMDowMDowMCIsImFsZyI6…",
   "refresh_token": "zmRTQFKhASUdF76Av6IUzi9dtB7ip8F2XV5fNgoRQ0mbQgD5XCeWkQhjlJ1dZi8K…",
   "token_type": "Bearer",
   "expires_in": 3600,
   "expiration": 1505865282
}

Use the value of the access_token property for your IBM Analytics Engine API calls. Set the access_token value as the authorization header parameter for requests to the IBM Analytics Engine APIs. The format is Authorization: Bearer <access_token_value>.

For example:
```
Authorization: Bearer eyJraWQiOiIyMDE3MDgwOS0wMDowMDowMCIsImFsZyI6IlJTMjU2In0...
```

Create a token using the IBM Cloud CLI

Before you can create a token by using the IBM Cloud CLI, check that you have met the following prerequisites:

You have a valid IBMid.
You have downloaded and installed the IBM Cloud CLI.

To create a token using IBM Cloud CLI:

Log in to the IBM Cloud CLI:
```
ibmcloud api https://cloud.ibm.com
ibmcloud login <enter your credentials>
```
If you have multiple IBM Cloud accounts, you'll be asked to choose an account for the current session. Also, you'll need to choose an organization and space in IBM Cloud.
Fetch the IAM access token:
```
ibmcloud iam oauth-tokens
```
The output returns the IAM token.

When you use the token, remove Bearer from the value of the token that you pass in API calls.