> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qwoty.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the Qwoty API

## API Tokens

Qwoty uses API tokens to authenticate requests. You can generate and manage API tokens from your dashboard under **Settings** → **Developer** → **API Tokens**.

## Authentication Header

Include your API token in the `Authorization` header of each request:

```bash theme={null}
Authorization: Bearer qwoty_your_api_token_here
```

## Using the API Playground

To test endpoints in the documentation:

1. **Look for the Authorize button** (🔒) in the top-right corner of any API endpoint page
2. Click it and paste your token (with or without "Bearer " prefix)
3. The token will be automatically included in all subsequent requests

**Alternative method:**
If the Authorize button is not visible, you can manually add the header in the playground:

* Open any endpoint
* Find the "Headers" section
* Add: `Authorization: Bearer qwoty_your_token`

## Complete Example

```bash theme={null}
curl https://qwoty.app/api/payment-terms \
  -H "Authorization: Bearer qwoty_your_api_token_here"
```

<Warning>
  Never share your API token in publicly accessible areas such as GitHub,
  client-side code, or public forums.
</Warning>

## Token Format

API tokens follow this format:

* Prefix: `qwt_prod_`
* Length: Variable, typically 64-128 characters
* Example: `qwt_prod_e75fc200cd7ea8da9bebf...`

## Workspace Scope

Each API token is scoped to a specific workspace. All API operations will:

* Only access data within that workspace
* Respect the token's permissions
* Enforce workspace-level rate limits

## Security Best Practices

<AccordionGroup>
  <Accordion title="Store Tokens Securely">
    * Use environment variables - Never commit tokens to version control -
      Rotate tokens regularly - Use different tokens for different environments
      (dev, staging, production)
  </Accordion>

  <Accordion title="Token Permissions">
    Each token has specific permissions. Create tokens with minimal required
    permissions for each use case.
  </Accordion>

  <Accordion title="Revoke Compromised Tokens">
    If a token is compromised, immediately revoke it from your dashboard and
    generate a new one.
  </Accordion>
</AccordionGroup>

## Error Codes

### Authentication Errors

| Status Code | Error        | Description                                      |
| ----------- | ------------ | ------------------------------------------------ |
| `401`       | Unauthorized | Missing or invalid API token                     |
| `403`       | Forbidden    | Token doesn't have permission for this operation |

### Example Error Response

```json theme={null}
{
  "success": false,
  "error": "Invalid API token"
}
```

## Need Help?

Contact our support team at [support@qwoty.io](mailto:support@qwoty.io) for any questions about authentication.