Oracle Cloud Authentication

generated: '2026-08-29'
method: searched
source: >-
  https://docs.oracle.com/en-us/iaas/Content/API/Concepts/signingrequests.htm and
  https://docs.oracle.com/en-us/iaas/Content/API/Concepts/sdk_authentication_methods.htm,
  corroborated against openapi/_original/ (Oracle's own Swagger 2.0 contracts).
docs: https://docs.oracle.com/en-us/iaas/Content/API/Concepts/sdk_authentication_methods.htm
provider: Oracle Cloud Infrastructure
providerId: oracle-cloud
summary:
  types:
    - http-signature
  oauth2: false
  api_key_header: false
  bearer_token: false
primary_scheme:
  name: OCI Request Signature
  type: http-signature
  standard: draft-cavage-http-signatures-08
  standard_statement: >-
    Verbatim from Oracle: "It's a draft specification that forms the basis for how Oracle handles
    request signatures."
  header: Authorization
  scheme_token: Signature
  header_note: >-
    Verbatim: "The Oracle Cloud Infrastructure signature uses the Signature Authentication scheme
    (with an Authorization header), and not the Signature HTTP header."
  format: >-
    Authorization: Signature version="1",keyId="<tenancy_ocid>/<user_ocid>/<key_fingerprint>",
    algorithm="rsa-sha256",headers="<space separated list>",signature="<base64>"
  algorithm: rsa-sha256
  algorithm_note: 'Mandatory. Oracle: "The signing algorithm must be RSA-SHA256."'
  key_id_format: ocid1.tenancy.oc1..<id>/ocid1.user.oc1..<id>/<key_fingerprint>
  signed_headers:
    get_and_delete: ['(request-target)', host, 'date or x-date']
    post_and_put: ['(request-target)', host, 'date or x-date', x-content-sha256, content-type, content-length]
    post_and_put_note: >-
      Verbatim: "For PUT and POST requests, your client must compute the x-content-sha256 and
      include it in the request and signing string, even if the body is an empty string. Also, the
      content-length is always required in the request and signing string, even if the body is
      empty."
    object_storage_exception: >-
      For Object Storage PutObject / UploadPart only (request-target), host and date/x-date are
      required.
  rules:
    - Header names must be lowercase in the signing string.
    - Query parameters must appear in the signing string in the same order as in the request.
    - 'Clock skew over 5 minutes returns 401 NotAuthenticated.'
credential_sources:
  - id: api-key
    name: API signing key (config file)
    description: RSA key pair; the public key is uploaded via UploadApiKey and identified by fingerprint. Config at ~/.oci/config.
    used_by: [SDKs, CLI, Terraform provider, Oracle MCP servers over stdio]
  - id: instance-principal
    name: Instance principal
    description: A compute instance authenticates as itself using a certificate issued by the instance metadata service. No key on disk.
  - id: resource-principal
    name: Resource principal
    description: A Function, Data Science job or other managed resource authenticates as itself.
  - id: session-token
    name: Security token (session)
    description: Browser-based `oci session authenticate`; short-lived token in the config profile.
  - id: workload-identity
    name: Workload identity
    description: An OKE pod authenticates as a Kubernetes service account mapped to an OCI principal.
  - id: obo
    name: Instance-obo-user
    description: An instance acting on behalf of the user who launched the session.
authorization:
  model: IAM policies
  description: >-
    OCI has no roles or scopes. Access is granted by plain-language policy statements attached to a
    compartment or tenancy, e.g. `Allow group Developers to manage instance-family in compartment Dev`.
  failure_modes:
    - {status: 401, code: NotAuthenticated, meaning: Signature, key id or clock is wrong.}
    - {status: 403, code: NotAuthorized, meaning: Authenticated, but no policy grants the operation.}
    - {status: 403, code: NotAllowed, meaning: The operation must be directed at the tenancy home region (IAM writes).}
    - {status: 404, code: NotAuthorizedOrNotFound, meaning: Deliberately conflates "does not exist" with "not permitted".}
oauth:
  control_plane: false
  note: >-
    OAuth 2.0 / OIDC appear at the edges of OCI — identity domains issue tokens for console and
    application sign-in, and the HTTP transport of Oracle's own MCP server requires an OCI IAM
    confidential application with the scope `oci_mcp.<server>.invoke` — but the OCI REST control
    plane described by the contracts in this repo does not accept bearer tokens.
  scopes_artifact: null
  scopes_note: >-
    derive-oauth-scopes.py found zero oauth2 securitySchemes across this repo, so no scopes/
    artifact is emitted. That is correct, not a gap.
corrections:
  - date: '2026-08-29'
    was: >-
      The previous derived revision recorded the scheme as `type: http, scheme: bearer` named
      `ociSignature`, inherited from the AE-authored specs in openapi/_ae-authored/.
    now: >-
      Corrected to an HTTP request-signature scheme per draft-cavage-http-signatures-08. OCI does
      not accept a bearer token, and an agent told otherwise will fail every call with 401.
schemes:
  - name: ociSignature
    type: http-signature
    scheme: signature
    description: OCI request signature authentication using RSA API signing keys (draft-cavage-http-signatures-08).
    sources:
      - openapi/_original/oracle-cloud-core-services-openapi.yaml
      - openapi/_original/oracle-cloud-identity-openapi.yaml
      - openapi/_original/oracle-cloud-object-storage-openapi.yaml
      - openapi/_original/oracle-cloud-database-openapi.yaml
      - openapi/_original/oracle-cloud-kubernetes-engine-openapi.yaml
      - openapi/_original/oracle-cloud-monitoring-openapi.yaml
      - openapi/_original/oracle-cloud-functions-openapi.yaml
      - https://docs.oracle.com/en-us/iaas/Content/API/Concepts/signingrequests.htm
    spec_note: >-
      Oracle's own Swagger 2.0 documents declare NO securityDefinitions at all. The scheme is
      documented only in prose, which is why this artifact is method:searched rather than derived.