> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dataerai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API requests with an OAuth2 access token for programmatic access, or a session cookie when calling from the signed-in web app.

The Dataerai API supports two authentication methods.

## OAuth2 access token (programmatic access)

For scripts, the CLI, the SDKs, and other integrations, authenticate with an **OAuth2 access token** sent as a bearer token:

```
Authorization: Bearer <access-token>
```

You obtain a token by signing in through the browser or **device** flow. The [CLI](/cli/authenticate) and [SDKs](/sdks/python) run this flow for you, store the token, and refresh it automatically — so in practice you sign in once and let the client handle the rest.

There is no separate "create an API key" page in the web app: a token is the result of completing the sign-in flow. The flow is PKCE-protected, and tokens carry `read` and `write` scopes by default (`openid` is also available to share your email). Access tokens are short-lived and a refresh token is exchanged for a fresh one in the background, so long-running clients keep working without you signing in again.

### Use a token in a request

Once a client has signed in, send the access token as a bearer token on any REST call:

```bash theme={null}
curl -H "Authorization: Bearer $DATAERAI_TOKEN" \
  "https://<your-server>/api/projects/"
```

### Sign in without a browser

On a headless host — a server, an HPC node, or a CI runner — use the **device flow**: a client starts it, prints a short verification URL and code, and you approve the request from any device with a browser. The [CLI runs this for you](/cli/authenticate#device-login-without-a-browser) with `dataerai auth login --device`.

## Session cookie (web app)

When you're signed in to the Dataerai web app, requests are authenticated with a **session cookie**. This is what the browser app uses; programmatic callers should use an access token instead.

## Trying endpoints here

The interactive playground on each endpoint page sends real requests to the server you configure. Provide a valid credential to call authenticated endpoints, and never paste a production token into a shared or public environment.

## Next steps

<CardGroup cols={2}>
  <Card title="Authenticate the CLI" icon="terminal" href="/cli/authenticate">
    Get a token with the browser or device flow.
  </Card>

  <Card title="API reference" icon="code" href="/api-reference/introduction">
    Base URL, formats, and conventions.
  </Card>
</CardGroup>