> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asobeast.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate API requests

> Send a personal API token as a bearer header on every request. Create the token in Settings, where it is shown once and prefixed with asob_.

Send your personal API token as a bearer header on every request. There is no public endpoint and no anonymous mode.

<CodeGroup>
  ```bash cURL theme={null}
  curl -H "Authorization: Bearer asob_…" \
    https://your-host/api/backend/health
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch("https://your-host/api/backend/health", {
    headers: { Authorization: `Bearer ${process.env.ASOBEAST_API_TOKEN}` },
  });
  const health = await response.json();
  ```

  ```python Python theme={null}
  import os, requests

  response = requests.get(
      "https://your-host/api/backend/health",
      headers={"Authorization": f"Bearer {os.environ['ASOBEAST_API_TOKEN']}"},
  )
  health = response.json()
  ```
</CodeGroup>

## Two credential types

| Credential         | Used by                                         | Obtained from                             |
| ------------------ | ----------------------------------------------- | ----------------------------------------- |
| Session cookie     | The dashboard in a browser                      | Signing in. The proxy forwards it for you |
| Personal API token | Scripts, the MCP server, continuous integration | The API tokens card in Settings           |

Both carry the same access and the same entitlement checks. A token is not a reduced credential, so give each consumer its own and revoke individually. See [Personal API tokens](/security/api-tokens).

## Status codes you will see

| Status                              | Meaning                                                                             |
| ----------------------------------- | ----------------------------------------------------------------------------------- |
| `401`                               | The credential is missing, malformed, revoked or signed with a rotated secret       |
| `402`                               | The account is not entitled, which only happens when `BILLING_ENABLED` is `true`    |
| `404` on `/docs` or `/admin/queues` | You are not an owner. These surfaces answer `404` rather than confirming they exist |

A `401` after a deployment usually means `AUTH_SECRET` was rotated, which invalidates sessions. Personal API tokens survive a rotation, because they are stored as hashes rather than signed. See [Rotate secrets](/operations/rotate-secrets).

## Keep the token out of your history

Read it from an environment variable rather than typing it into a shell.

```bash theme={null}
export ASOBEAST_API_TOKEN=asob_…
curl -H "Authorization: Bearer $ASOBEAST_API_TOKEN" \
  https://your-host/api/backend/apps
```

## Related

<CardGroup cols={2}>
  <Card title="Error responses" icon="triangle-alert" href="/api-reference/errors">
    The envelope every failure returns.
  </Card>

  <Card title="Authentication and accounts" icon="lock" href="/security/authentication">
    Sessions, guards and entitlements.
  </Card>
</CardGroup>