# Authentication

> Source: https://elaichi.ai/docs/api-reference/overview/authentication/

Every request carries an API token in the `Authorization` header:

```http
Authorization: Bearer $ELAICHI_API_TOKEN
```

A token belongs to one organization and to the person who created it. Requests run with that person's permissions — a token can never do more than they can.

## Create a token

1. Sign in at [app.elaichi.ai](https://app.elaichi.ai) and switch to the organization you want to automate.
2. Open **Settings → API tokens**.
3. Choose **Create** and name the token after where it will be used, such as `CI pipeline`.
4. **Copy the token now.** It's shown once and can't be retrieved later.
5. Store it in a password manager or your secret store — never in source control.

The [Create API tokens](/guides/settings/api-tokens) guide walks through the same screen with more detail.

## Use it

```bash
curl https://api.elaichi.ai/connection \
  -H "Authorization: Bearer $ELAICHI_API_TOKEN"
```

Keep the token in an environment variable rather than pasting it into scripts.

## Permissions

Most endpoints that change something require a specific permission, such as creating a toolbox. Those permissions come from the roles of the person who created the token, so:

- Changing their roles changes what the token can do, immediately.
- Revoking the token cuts access straight away.

A `403 forbidden` response means the token is valid but the underlying account lacks the permission. Check that person's roles in **Members & Roles**.

## Rotate and revoke

Delete a token from **Settings → API tokens** the moment it's no longer needed, or if it might have leaked. Revocation is immediate and can't be undone — create a new token and update your integration.

For a leaked token, revoke first and rotate second. It's the fastest way to close the gap.