> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lekalao.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API tokens: creating them, using them, keeping them safe.

Every call to the API carries a token in the `Authorization` header:

```http theme={null}
Authorization: Bearer 12|kJ3v8mQ2xP9…
Accept: application/json
```

## Create a token

In **Settings → API tokens → New token** (editor or owner role). The token is shown **once only**. Details in [API tokens and webhooks](/account/integrations).

## What it may do

| Ability                              | Routes                                                                            |
| ------------------------------------ | --------------------------------------------------------------------------------- |
| **Read** (`read`)                    | Every `GET` route.                                                                |
| **Read and write** (`read`, `write`) | Those plus `POST`, `PUT`, `DELETE`, and the [SMTP relay](/developers/smtp-relay). |

A read-only token that tries to write gets `403`.

## Which team it works for

A token works for **the team it was created in**, and for that team only. It sees nothing of its owner's other teams, even when they switch team in the browser.

It also acts with **its owner's rights in that team**, checked on every call:

* if the owner becomes a **viewer**, writes answer `403`;
* if they **leave the team**, every call answers `403`;
* if the team is **suspended**, every call answers `403` with a message that says so.

<Tip>
  For a lasting integration, create tokens from a service account (say
  `api@myshop.example`, editor role) rather than from the account of someone
  who may leave the team.
</Tip>

## Good habits

* **One token per application.** You will know which one to revoke.
* **The least you need.** A dashboard that reads statistics only needs **Read**.
* **Server side only.** A token in browser JavaScript or in a mobile application is public. To subscribe from a browser, use the [form](/developers/forms), which needs no token.
* **In a vault.** An environment variable or a secret manager, never in the repository.
* **Revoke** at the first doubt: **Settings → API tokens → Revoke** cuts access immediately. The **Last used** column helps spot a forgotten token.

## Authentication answers

| Code  | Cause                                                                  |
| ----- | ---------------------------------------------------------------------- |
| `401` | Token missing, malformed or revoked: `{"message": "Unauthenticated."}` |
| `403` | Valid token, but the ability, the role or the team does not allow it.  |