--- title: "Secure Token Service overview" slug: "management-sts" tags: ["Secure Token Service"] updated: 2026-09-17T10:05:35Z published: 2026-09-17T10:05:35Z canonical: "api.ncloud-docs.com/management-sts" --- > ## Documentation Index > Fetch the complete documentation index at: https://api.ncloud-docs.com/llms.txt > Use this file to discover all available pages before exploring further. # Secure Token Service overview Available in Classic and VPC Secure Token Service (STS) is a service that issues temporary credentials (access key, secret key) for sub accounts that can control access to resources in NAVER Cloud Platform. Secure Token Service provides APIs for temporary credentials for sub accounts in RETSTful form. Temporary credentials created using the Secure Token Service have the following characteristics. - They can be created from sub accounts. - They have the same validity as permanent access keys, with some differences. - They have an expiration date. Expired access keys are not recognized or allowed access, so they do not need to be replaced or explicitly replaced when they are no longer needed. - You don't need to distribute or embed access keys with an indefinite duration into your applications. - You can include MFA authentication when generating temporary credentials. NAVER Cloud Platform provides OTP authentication as a means of MFA. ## Common Secure Token Service settings The following describes commonly used request and response formats in Secure Token Service APIs. ### Request The following describes the common request format. #### API URL The request API URL is as follows: ``` https://sts.apigw.ntruss.com ``` #### Request headers The following describes the request headers. | Field | Required | Description | | --- | --- | --- | | `x-ncp-apigw-timestamp` | Required | This is the number of milliseconds that have elapsed since January 1, 1970 00:00:00 UTC. - Request is considered invalid if the timestamp differs from the current time by more than 5 minutes. - Unix timestamp format. | | `x-ncp-iam-access-key` | Required | Access key issued on NAVER Cloud Platform - Issue and check access key: See [Create authentication key](/docs/en/common-ncpapi#1%EC%9D%B8%EC%A6%9D%ED%82%A4%EC%83%9D%EC%84%B1). - Issue and check access key for sub account: See [Create sub account](https://guide.ncloud-docs.com/docs/en/subaccount-use#%EC%84%9C%EB%B8%8C-%EA%B3%84%EC%A0%95-%EC%83%9D%EC%84%B1). | | `x-ncp-apigw-signature-v2` | Required | Base64-encoded signature that encrypts the request information with a secret key that maps to the access key issued on NAVER Cloud Platform, using the HMAC encryption algorithm (HmacSHA256). - Issue and check secret key: See [Create authentication key](/docs/en/common-ncpapi#1%EC%9D%B8%EC%A6%9D%ED%82%A4%EC%83%9D%EC%84%B1). - Create signature: See [Create signature](/docs/en/common-ncpapi#%EC%8B%9C%EA%B7%B8%EB%8B%88%EC%B2%98%EC%83%9D%EC%84%B1). | | `Content-type` | Required | Request data format`application/json` | ### Response The following describes the common response format. #### Response status codes The following describes the response status codes. | HTTP status code | Code | Message | Description | | --- | --- | --- | --- | | 400 | 400 | durationSec is only available in the following ranges: Valid range: 600-43200: [durationSec] | `durationSec` range specification error | | 401 | 401 | MultiFactorAuthentication failed with invalid MFA one time pass code | Invalid OTP. | | 404 | 404 | Invalid or expired credentials | Invalid credentials | Note For information about the HTTP status codes common to NAVER Cloud Platform, see [Ncloud API response status codes](/docs/en/common-ncpapi#3%EC%9D%91%EB%8B%B5%EC%83%81%ED%83%9C%EC%BD%94%EB%93%9C). ## Secure Token Service API The following describes the APIs provided by Secure Token Service. | API | Description | | --- | --- | | [Get credential owner](/docs/en/get-caller-identity) | Get the access key owner. | | [Get credentials](/docs/en/management-sts-getsts) | Get temporary credentials for sub accounts or permanent access keys for sub accounts and main account. | | [Create temporary credentials](/docs/en/management-sts-creatests) | Create temporary credentials for a sub account. | | [Switch temporary credential roles](/docs/en/switch-role) | Create temporary credentials with a role switch. | ## Secure Token Service related resources NAVER Cloud Platform provides a variety of related resources to help users better understand Secure Token Service APIs. - Secure Token Service API guides - [API overview](/docs/en/common-ncpapi): How to issue and check access key and secret key issued by NAVER Cloud Platform, how to generate the signature required for request headers - [Sub Account User Guides](https://guide.ncloud-docs.com/docs/en/subaccount-overview): How to issue and check access keys for sub accounts issued by NAVER Cloud Platform - [Common Ncloud response status codes](/docs/en/common-ncpapi#3%EC%9D%91%EB%8B%B5%EC%83%81%ED%83%9C%EC%BD%94%EB%93%9C): Information on common response status codes of NAVER Cloud Platform used by Secure Token Service - How to use the Sub Account service - [Sub Account User Guides](https://guide.ncloud-docs.com/docs/en/subaccount-overview): How to use the Sub Account service in the NAVER Cloud Platform console - [Ncloud user environment guide](https://guide.ncloud-docs.com/docs/en/environment-environment-1-1): Explore VPC and Classic environments and supported services. - [Pricing and features](https://www.ncloud.com/product/management/resourceManager): View pricing details and key capabilities. - [Latest service news](https://www.ncloud.com/intro/news): The latest news on the Sub Account service - [FAQs](https://www.ncloud.com/support/faq/all):Get answers to common Secure Token Service questions. - [Contact Support](https://www.ncloud.com/support/question/general): Get help if you can't find what you need in the API guide.