This is an old revision of the document!

Server-to-server authentication

In order for instances to verify each other's identity, a weak authentication mechanism is used, based on a simple DNS dialback negotiation. The process goes roughly like this:

Server A wants to prove its identity to Server B
Server A tells Server B its dialback endpoint, via Server B's auth endpoint listed in its instance metadata
Server B independently connects to the given endpoint and sends a secret token
Server A, having received the secret, sends it back to Server B's auth endpoint
Server B responds with an auth token, which Server A can use in subsequent requests to prove who it is

This article is a stub. If you have an account on this wiki, you can help by expanding it.