Use virtual private endpoints for VPC to privately connect to IBM Quantum Platform

Use Virtual Private Endpoints (VPE) for Virtual Private Cloud (VPC) to connect to IBM Quantum® from your VPC network. The connection uses the IP address that you specify, allocated from a subnet within your VPC.

VPEs are virtual IP interfaces that are bound to an endpoint gateway created on a per-service basis. The endpoint gateway is a virtualized function that scales horizontally, is redundant and highly available, and spans all availability zones of your VPC. Endpoint gateways enable communications from virtual server instances within your VPC and IBM Cloud® service on the private backbone. VPE for VPC lets you control all private addressing within your cloud. For more information, see About virtual private endpoint gateways.

Regardless of whether you use VPEs, all internal communication within IBM Quantum Platform's network always uses private connections rather than the public internet.

Whether your connection to IBM Quantum Platform itself is public or private depends on whether you use a VPE. Connecting through the public endpoints transmits all request and response data over the public internet. Connecting through a VPE keeps that traffic on the private network instead.

VPEs are supported only for the IBM Quantum Platform API and SDK, as described in the following sections. The IBM Quantum Platform website does not support VPEs and can only be accessed over the public network.

Before you begin

Before you target a VPE for IBM Quantum Platform, complete the following steps:

• Create a Virtual Private Cloud.
• Plan for the network topology to connect to VPEs.
• Set access controls for your VPE.
• Understand the service restrictions.
• Understand how to view VPE details.

Set up a VPE for IBM Quantum Platform

There are several ways to create a VPE gateway. If you use the CLI or API, you must specify the Cloud Resource Name (CRN) of the region in which you want connect to IBM Quantum Platform. Review the following table for the available regions and CRNs.

Configuring an endpoint gateway

To configure a VPE gateway, follow these steps:

1. List the available services, including IBM Cloud infrastructure services available (by default) for all VPC users.
2. Create an endpoint gateway for IBM Quantum Platform that you want to be privately available to the VPC.
3. Bind a reserved IP address to the endpoint gateway.
4. View the created VPE gateways associated with IBM Quantum Platform.

Now your virtual server instances in the VPC can access your IBM Quantum Platform instance privately.

Use your VPE for IBM Quantum Platform

After you create an endpoint gateway for IBM Quantum Platform, follow these steps:

Use the VPE with qiskit-ibm-runtime (Python SDK)

When instantiating QiskitRuntimeService, specify private_endpoint=True.

# For `token`, use the 44-character API_KEY you created 
# and saved from the IBM Quantum Platform Home dashboard
service = QiskitRuntimeService(token="your-API_KEY", 
                              instance="INSTANCE_CRN",
                              channel="ibm_cloud",
                              private_endpoint=True)

Use the VPE with the IBM Quantum API

After creating an endpoint gateway for IBM Quantum Platform, use the service endpoint's fully qualified domain name (FQDN) for the target region from the prior table.

  curl -X POST \
  https://private.us-east.quantum.cloud.ibm.com/api/v1/jobs \
  -H "Authorization: Bearer $BEARER_TOKEN" \
  -H "Service-CRN: $SERVICE_INSTANCE_CRN" \
  -d '{
    "backend": "backend",
    "program_id": "sampler"
  }'