---
title: How to manage authentication for private functions
description: This page explains how to manage authentication to call private functions
tags: authentication authentication-token functions auth iam access api secret key
dates:
  validation: 2025-11-24
  posted: 2022-10-14
---
import Requirements from '@macros/iam/requirements.mdx'

<Message type="important">
Scaleway Serverless Functions used to rely on JWT authentication tokens to access private resources. This feature is now deprecated, you must therefore use Scaleway IAM to access your private functions using an [API key](/iam/how-to/create-api-keys/).
</Message>

This page shows you how to manage authentication for private functions from the Scaleway console.

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- A [functions namespace](/serverless-functions/how-to/create-a-function/)
- A [function](/serverless-functions/how-to/create-a-function/)

## Managing authentication from the Scaleway console

Serverless Functions used to rely on a legacy token-based authentication to call private functions. [Scaleway IAM](/iam/) offers a modern way to access private resources using API keys.

<Tabs id="token-serverless">
  <TabsTab label="Scaleway IAM">
  1. [Create an IAM application](/iam/how-to/create-application/) that will be used as a principal for the policy granting access to your private function.

    2. [Create an API key](/iam/how-to/create-api-keys/) for your application. Store the secret key securely, as it is only shown once.

    3. [Create an IAM policy](/iam/how-to/create-policy/) with the following elements:
        - **Scope**: the desired Project(s)
        - **Principal**: the application you just created
        - **Permission set**:  `FunctionsPrivateAccess`

    You can now [use your private key as a token](#using-tokens) to call private functions. Example:

    ```curl
      curl -H "X-Auth-Token: <YOUR_FUNCTION_TOKEN>" <YOUR_FUNCTION_ENDPOINT>
    ```
  </TabsTab>
  <TabsTab label="JWT (legacy)">
    1. Click **Functions** in the **Serverless** section of the side menu. The Serverless Functions page displays.

    2. Click the relevant functions namespace to see a list of functions in this namespace.

    3. Click the name of the relevant function in the **Functions** tab. The function's **Code** tab displays.

    4. Click the **Security** tab. The function's security settings page displays.

    5. Set the **privacy policy** to **private**.

    6. Click **Generate token**. A pop-up displays.

    7. Enter the token description and set an expiration date for the token. Optionally, tick the box **No expiration date**, to get a token with unlimited validity. Then click **Generate token**.

    8. Copy the token from the pop-up and store it in a safe environment.

        <Message type="important">

        The token key will only be available to copy once. Make sure to store it securely before leaving the page.

        </Message>
  </TabsTab>
</Tabs>

## Calling private functions

To call a private function, you have to add the **secret key** of the [previously created API key](#managing-authentication-from-the-scaleway-console) to a `X-Auth-Token` header.

A **private** function observes this behavior:

* If a call is made without the `X-Auth-Token` header, the call is rejected (status code 403).
* If the `X-Auth-Token` header is provided, the token is validated using the IAM API public key corresponding to the private key provided.

For example, to execute a private function by providing a secret key using `curl`, run the following command:

```bash
curl -H "X-Auth-Token: <API_SECRET_KEY>" <YOUR_FUNCTION_ENDPOINT>
```

## Revoking authentication

<Tabs id="revoke-authentication">
  <TabsTab label="Scaleway IAM">
    To revoke authentication for your function, delete the API key of your IAM application, or remove/modify the associated permissions.
  </TabsTab>
  <TabsTab label="JWT (legacy)">
    Tokens will expire by default on their given expiry date. You can delete them manually if they are no longer needed.

    1. Click **Functions** in the **Serverless** section of the side menu. The Serverless Functions page displays.

    2. Click the relevant functions namespace to see a list of functions in this namespace.

    3. Click the name of the relevant function in the **Functions** tab. The function's details display.

    4. Click the **Security** tab. A list of settings displays.

    5. Click <Icon name="delete" /> next to the token you want to delete in the **Tokens** panel. A pop-up displays.

    6. Confirm by clicking **Delete token** to delete the token and to revoke access to the function.

        <Message type="important">

          This action is irreversible, and this token will not be able to access your function anymore.

        </Message>
  </TabsTab>
</Tabs>