> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stockshift.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Send an API key or an OAuth access token as a bearer token on every call.

Send a bearer token in the `Authorization` header on every call:

```http theme={null}
GET /api/v1/catalog/items HTTP/1.1
Host: app.stockshift.io
Authorization: Bearer 7|Zc1q...
Accept: application/json
```

A few endpoints, such as the mobile apps' sign in, take no token, and their entries in the API reference say so.

There are two kinds of token. The API treats them the same once they arrive.

| Token | For | Where it comes from |
| - | - | - |
| API key | Your own scripts and server-to-server integrations | A member creates it in the app |
| OAuth access token | Apps that other people connect to their StockShift account | Your app runs the [OAuth flow](https://docs.stockshift.io/guides/oauth-apps.md) |

## API keys

**Settings > Access > API keys** lists the organization's keys with their name, owner, scopes, when they were created, when they expire and when they were last used.

To create one, press **New API key**, give it a name, pick an expiry date (or none) and tick the scopes it needs. Copy the key when it is shown, because it is never shown again. Keys that expire are safer.

A key belongs to the member who made it and to the organization it was made in:

* It can never do more than that member can. Each call needs both the member's permission and one of the key's scopes. See [Permissions and scopes](https://docs.stockshift.io/guides/permissions-and-scopes.md).
* It cannot reach any other organization.
* If the member leaves the organization, the key stops working.

Press **Revoke** to stop a key at once. Anything using it gets `401` from then on, and the key stays in the list marked as revoked.

## When a token fails

| Status | `code` | Why |
| - | - | - |
| `401` | `unauthenticated` | No token, or one that has expired or been revoked. |
| `403` | `forbidden` | The member lacks the permission or the token lacks the scope. |

Keep keys out of source control and client-side code. Load them from your secret store or environment, as the examples here do with `STOCKSHIFT_TOKEN`.


## Related topics

- [.NET](https://docs.stockshift.io/sdks/dotnet.md)
- [Go](https://docs.stockshift.io/sdks/go.md)
- [PHP](https://docs.stockshift.io/sdks/php.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.