# Authentication

Every Layer REST API request must be authenticated with a **bearer token** in the `Authorization` header:

```bash
curl https://api.app.layer.ai/api/v1/workspaces \
  -H "Authorization: Bearer $LAYER_TOKEN"
```

The API base URL is `https://api.app.layer.ai/api`, and every endpoint is versioned under `/v1` — so full paths look like `https://api.app.layer.ai/api/v1/workspaces/{workspace_id}/...`.

## Personal Access Tokens

A **Personal Access Token (PAT)** is the recommended way to authenticate a server-side integration. Tokens are prefixed with `pat_`.

1. Log in to [app.layer.ai](https://app.layer.ai).
2. Go to **Settings → Personal Access Tokens**.
3. Click **Create Token**, give it a name (and an optional expiry), and copy the value.

Caution

The token value is shown **only once**, at creation time — Layer stores a hash, not the token. Store it in a secret manager; if you lose it, create a new one.

A PAT is created and managed **only in the app UI** — there is no REST endpoint to mint, list, or revoke tokens.

### Permissions

A PAT inherits **all** of the permissions of the user who created it — there are no per-token scopes. Treat a PAT as equivalent to that user’s access, and provision integration users with only the workspace access they need. Requests for actions the user isn’t allowed to perform return [403 FORBIDDEN](/docs/errors).

### Expiry

If you set an expiry when creating the token, requests made after that time fail with [401 UNAUTHENTICATED](/docs/errors). Rotate tokens before they expire.

## SSO / Auth0 tokens

The API also accepts an Auth0-issued JWT (the same session your browser uses) as the bearer token. This is intended for first-party, browser-based use — there is **no third-party OAuth app registration, client-credentials, or scopes flow** for the REST API. For programmatic integrations, use a PAT.

Note

The [MCP server](/docs/mcp) has its own OAuth-based connection flow for AI clients. That’s separate from REST API authentication — see the MCP server guide.

## Keeping tokens safe

* Never embed a PAT in client-side code or a public repository — the API is [server-to-server only](/docs/integration-notes).
* Scope integration users to the minimum workspace access required.
* Rotate tokens periodically and on suspected exposure.