Before you begin

• Create a Pay-As-You-Go or Subscription IBM Cloud account. Trial accounts are not supported. For more information or to upgrade your account, see Account types.

• Create a Red Hat AI Inference project.

• Make sure that you have the Writer role or greater on the Red Hat AI Inference service. For more information, see Managing IAM access.

Authenticating by using a bearer token

Bearer tokens ensure secure access to your project's inference capabilities and are generated from your IBM Cloud API key. Bearer tokens expire after a set period, so they must be refreshed periodically.

The following example shows how to retrieve a bearer token.

curl -X POST "https://iam.cloud.ibm.com/identity/token" --header "Content-Type: application/x-www-form-urlencoded" --header "Accept: application/json" --data-urlencode "grant_type=urn:ibm:params:oauth:grant-type:apikey" --data-urlencode "apikey=$<IBM_CLOUD_API_KEY>"

The bearer token is the access_token in the response. These tokens have an expiration date and must be periodically refreshed.

{"access_token":"xxxxx","refresh_token":"not_supported","token_type":"Bearer","expires_in":3600,"expiration":1770058324,"scope":"ibm openid"}

Authenticating by using an API key

You can authenticate with an API key by using either a service ID API key or a user API key.

Using a service ID is the recommended method to manage and delegate access permissions. After you create a service ID, create a service ID API key to authenticate your requests. For details on creating a service ID and an API key within your project, see Getting started with Red Hat AI Inference.

When you create the service ID in IAM, assign the Writer service access role to create chat completions. Assign the Reader service access role if you need only to view model information or read chat completions. Platform access roles are not required for API access.

Alternatively, you can authenticate by using a personal user API key. For more information, see Managing user API keys.