Authentication

Infino uses AWS Signature Version 4 (SigV4) for API authentication, providing secure, request-level signing that ensures data integrity and prevents replay attacks.

Authentication Method

All API requests must be signed using AWS Signature Version 4 with your Infino access key and secret key.

Getting Credentials

When you create an account through the Infino UI, you will receive authentication credentials that look like this:

{
  "account_id": "123456789012",
  "access_key": "IAK_abcd1234efgh5678",
  "secret_key": "xyz789abc123def456ghi789jkl012mno345",
  "username": "john_doe"
}

Important

Credentials are only shown once during account creation in the UI.

• Store them securely immediately
• The secret key cannot be retrieved later
• You will need these credentials for all API requests

Quick Start (Recommended for Testing)

Using REST API Testing Tools

Any REST API testing tool like Postman or Bruno can be used:

1. Set authentication to "AWS Signature Version 4"
2. Use these values:
   • Access Key: <YOUR_ACCESS_KEY>
   • Secret Key: <YOUR_SECRET_KEY>
   • Region: us-east-1 (fixed value)
   • Service: es (fixed value)
3. Your tool handles all the signing automatically!

Signing Constants

These are the fixed values that must be used for all Infino API requests:

Constant	Value
Algorithm	AWS4-HMAC-SHA256
Service	es
Region	us-east-1
Termination	aws4_request

Implementation Examples

Python (using requests-aws4auth)

First, install the required packages:

pip install requests requests-aws4auth

Then use them in your code:

from requests_aws4auth import AWS4Auth
import requests

# Set up authentication
auth = AWS4Auth(
    access_key='<YOUR_ACCESS_KEY>',
    secret_key='<YOUR_SECRET_KEY>',
    region='us-east-1',
    service='es'
)

# Make authenticated request
response = requests.get(
    'https://api.infino.ws/my-logs/querydsl',
    auth=auth,
    headers={'Content-Type': 'application/json'},
    json={"query": {"match_all": {}}}
)

JavaScript (using aws4)

First, install the required package:

npm install aws4

Then use it in your code:

const aws4 = require('aws4');
const https = require('https');

const request = {
  host: 'api.infino.ws',
  method: 'POST',
  path: '/sql',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    query: "SELECT * FROM my_logs WHERE level='error'"
  })
};

// Sign the request
aws4.sign(request, {
  accessKeyId: '<YOUR_ACCESS_KEY>',
  secretAccessKey: '<YOUR_SECRET_KEY>',
  region: 'us-east-1',
  service: 'es'
});

// Make the request
const req = https.request(request, (res) => {
  console.log('Status:', res.statusCode);
});
req.end();

AWS CLI (for quick testing)

# Install AWS CLI and configure temporary credentials
aws configure set aws_access_key_id <YOUR_ACCESS_KEY>
aws configure set aws_secret_access_key <YOUR_SECRET_KEY>
aws configure set region us-east-1

# Use AWS CLI to make authenticated request  
aws --endpoint-url=https://api.infino.ws opensearch list-indices

Authentication Errors

403 Forbidden

{
  "error": "SignatureDoesNotMatch",
  "message": "The request signature we calculated does not match the signature you provided"
}

Common causes:

• Incorrect secret key
• Wrong timestamp (must be within 15 minutes)
• Malformed canonical request

401 Unauthorized

{
  "error": "InvalidAccessKeyId",
  "message": "The AWS Access Key Id you provided does not exist in our records"
}

Common causes:

• Wrong access key
• Account has been deactivated
• Key has been rotated

Security Best Practices

Key Rotation

Rotate your API keys periodically by sending a GET request to the following endpoint:

Endpoint: PATCH /user/{username}/keys

Authentication: This request must be authenticated using one of the methods described in the previous sections (REST API testing tools, Python/JavaScript libraries, or AWS CLI).

Note: Replace {username} with the actual username for the account where you want to rotate keys.

Troubleshooting

Common Authentication Issues

• Wrong credentials: Double-check your access key and secret key
• Incorrect region: Must be us-east-1 (not configurable)
• Wrong service: Must be es (not configurable)
• Expired timestamps: Ensure your system clock is accurate (tools handle this automatically)
• Account issues: Verify your account is active and credentials haven't been rotated

Multi-Tenancy

Infino uses account-based multi-tenancy. Each request is automatically scoped to your account based on the credentials used. No additional account ID headers are required for most operations.