Nextdc Authentication

generated: '2026-10-22'
method: searched
source: https://www.nextdc.com/knowledge-articles/axon-api-documentation
docs: https://www.nextdc.com/knowledge-articles/axon-api-documentation
summary:
  types:
  - apiKey
  api_key_in:
  - header
  signed_requests: true
schemes:
- name: axon_hmac_api_key
  type: apiKey
  in: header
  parameter: X-API-Key
  format: 'key:digest'
  companion_headers:
  - name: X-API-TS
    purpose: nonce (unix timestamp with millisecond or better resolution, e.g. date '+%s.%N')
  signature:
    algorithm: HMAC-SHA256
    signed_string: method + path (query parameters excluded) + nonce, no spaces
    encoding: hex (the digest is not base64 encoded)
  replay_protection: 'The AXON API requires an increasing, never repeated nonce to guard against replay attacks.'
  clock_skew: 'Clients need to ensure that the nonce time is accurate to within 2 minutes of the API server time otherwise authentication will fail.'
  provisioning: 'Please speak to your pre-sales representative to request API access and the process to obtain an API key and sandbox access. You will need to supply an existing AXON user that you wish to grant API access to and the source IP addresses that you will be accessing the API from.'
  ip_allowlist: true
  sources:
  - https://www.nextdc.com/knowledge-articles/axon-api-documentation
- name: api_key
  type: apiKey
  in: query
  parameter: api_key
  note: Declared in the Swagger 2.0 contract (openapi/nextdc-axon-openapi.yml); the docs describe the header-based HMAC scheme above instead.
  sources:
  - openapi/nextdc-axon-openapi.yml
authorization_model: 'The company access control model in AXON is hierarchical. This means that having access at a specific level in the hierarchy,access flows down to sub-companies.'