REST API Authentication

All REST APIs that Cloud9 offers employ the same high-level security measures to authenticate and secure the messaging. Authentication and security are provided through a firm-specific key/secret pair, the whitelisting of client IPs, and enforced server-side SSL.

API Key Management

In order to make any API call to Cloud9, the client must first generate an API key/secret through the Cloud9 Portal. Only authorized firm admins are allowed access to the Cloud9 Portal, and further permissions can be applied to allow only certain admins to view or modify the firm’s API keys. Portal access is protected with a user-specific username and password as well as multi-factor authentication. The Portal enforces server-side SSL.

API Key Management

HMAC Generation

When an admin generates a new key, the public key and secret is displayed to the admin. The key/secret pair provide two levels of security.

The HMAC Generation section addresses how to use the API key and secret to generate the necessary authentication to make a successful request to an API endpoint. This section provides code examples covering the creation of the authentication signature in a variety of languages. Not all code examples are complete, and they should be viewed as an illustrative approach. For example, most examples leave the detail of the HTTP request to Cloud9 up to the customer, as they may have their own preferred library and/or a network topology necessitating a specific approach.

HMAC Generation