F5 Authentication

generated: '2026-09-07'
method: searched
source: >-
  Derived from the securitySchemes and prose of the five contracts in openapi/, then upgraded from
  the provider's own documentation: https://docs.nginx.com/nginx-one-console/api/authentication/
  (200), https://nginx.org/en/docs/http/ngx_http_api_module.html (200),
  https://clouddocs.f5.com/api/icontrol-rest/ (200), the vesctl README at
  https://gitlab.com/volterra.io/vesctl/-/raw/main/README.md (200), and the OIDC discovery document
  saved to well-known/f5-my-openid-configuration.json. All probed 2026-09-07.
docs:
  - https://docs.nginx.com/nginx-one-console/api/authentication/
  - https://clouddocs.f5.com/api/icontrol-rest/
  - https://nginx.org/en/docs/http/ngx_http_api_module.html
description: >-
  F5 has no single authentication story because it has no single API. There is no F5 account, no
  F5-issued API key, and no OAuth anywhere in the product estate. What there is: device credentials
  for the BIG-IP APIs, an nginx.conf policy decision for the NGINX Plus API, and a tenant-scoped
  token or client certificate for the two hosted surfaces. An integrator needs to know which of the
  three they are in before writing a line of code.
summary:
  types:
    - http
    - apiKey
    - mutualTLS
    - none
  api_key_in:
    - header
  oauth2: false
  oauth2_note: >-
    No securityScheme of type oauth2 or openIdConnect appears in any published F5 contract. The one
    OIDC surface F5 serves (my.f5.com) authorizes the Salesforce-backed support portal, not any
    product API — see conformance/f5-conformance.yml.
schemes:
  - name: Basic
    type: http
    scheme: basic
    applies_to:
      - F5 BIG-IP iControl REST
      - F5 BIG-IP AS3
      - F5 BIG-IP FAST
      - F5 BIG-IP Declarative Onboarding
    description: >-
      HTTP Basic over TLS using a BIG-IP administrative user. Works on every /mgmt/ endpoint and is
      the simplest path for a script. The credential is a device account, not an F5 cloud account.
    sources:
      - openapi/f5-mgmt-api-openapi.yml
      - https://clouddocs.f5.com/api/icontrol-rest/
  - name: Token
    type: apiKey
    in: header
    parameter: X-F5-Auth-Token
    applies_to:
      - F5 BIG-IP iControl REST
      - F5 BIG-IP AS3
      - F5 BIG-IP FAST
      - F5 BIG-IP Declarative Onboarding
    token_endpoint: POST /mgmt/shared/authn/login
    token_request:
      username: string
      password: string
      loginProviderName: tmos
    ttl_seconds: 1200
    description: >-
      A device-issued token exchanged for username/password at /mgmt/shared/authn/login. Default
      timeout is 1200 seconds; the token resource can be PATCHed to extend it. Preferred over Basic
      for anything long-running because it avoids replaying the password on every call.
    sources:
      - openapi/f5-mgmt-api-openapi.yml
      - https://clouddocs.f5.com/api/icontrol-rest/
  - name: APIToken
    type: apiKey
    in: header
    parameter: Authorization
    format: 'Authorization: APIToken <token-value>'
    applies_to:
      - F5 Distributed Cloud
      - NGINX One Console
    description: >-
      Tenant-scoped API token generated in the F5 Distributed Cloud / NGINX One console. Note the
      non-standard scheme name — it is "APIToken", not "Bearer", and a client that assumes Bearer
      will fail authentication.
    sources:
      - https://docs.nginx.com/nginx-one-console/api/authentication/
  - name: P12ClientCertificate
    type: mutualTLS
    applies_to:
      - F5 Distributed Cloud
      - NGINX One Console
    description: >-
      A PKCS#12 bundle (key + certificate) downloaded from the tenant console, with the passphrase
      supplied separately. This is the default for vesctl, which reads it from $HOME/.vesconfig as
      the `p12-bundle` key and takes the password from the VES_P12_PASSWORD environment variable.
      Certificate-based auth is awkward for ephemeral agent and CI environments — plan the secret
      handling before choosing it over the API token.
    sources:
      - https://docs.nginx.com/nginx-one-console/api/authentication/
      - https://gitlab.com/volterra.io/vesctl/-/raw/main/README.md
  - name: NoneDeclared
    type: none
    applies_to:
      - NGINX Plus REST API
    description: >-
      The NGINX Plus REST API declares no securityScheme, and that is deliberate rather than an
      omission in the contract. Access control is a configuration concern enforced in the nginx.conf
      location that serves the API — allow/deny, auth_basic, or client certificates, whatever the
      operator chose. Write access is separately gated by the `api write=on;` directive; without it
      every mutation returns 405 with internal error code MethodDisabled.
      The practical consequence: an NGINX Plus API is unauthenticated and read-only until an
      operator decides otherwise, and an agent cannot discover which of those it is facing except
      by trying.
    sources:
      - openapi/f5-nginx-plus-api-openapi.yml
      - https://nginx.org/en/docs/http/ngx_http_api_module.html
base_urls:
  - api: F5 BIG-IP iControl REST / AS3 / FAST / DO
    base: https://{bigip}/mgmt/
    hosted_by: customer
  - api: NGINX Plus REST API
    base: https://{nginx-host}/api/{version}
    hosted_by: customer
  - api: F5 Distributed Cloud
    base: https://{tenant}.console.ves.volterra.io/api
    hosted_by: F5
  - api: NGINX One Console
    base: https://{tenant}.console.ves.volterra.io/api/nginx/one/namespaces/{namespace}/{kind}
    hosted_by: F5
portal_identity:
  host: my.f5.com
  protocol: OpenID Connect
  discovery: well-known/f5-my-openid-configuration.json
  issuer: https://my.f5.com
  note: >-
    F5's customer support portal serves a complete OIDC discovery document. It runs on Salesforce
    Experience Cloud — the scopes_supported list is the Salesforce platform vocabulary — and it
    authorizes the portal, not BIG-IP, NGINX or Distributed Cloud APIs. Recorded here so it is not
    mistaken for a product API auth surface.