> ## Documentation Index
> Fetch the complete documentation index at: https://docs.proconvey.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate your API requests using bearer tokens

Our API uses bearer token authentication to secure your requests.

## Bearer Token Authentication

Bearer tokens provide a straightforward way to authenticate API requests. Include your token in the Authorization header of each request.

### Getting your bearer token

1. Log into your dashboard
2. Navigate to **Settings > Integrations**
3. Generate a new API key
4. Copy and securely store your token

<Warning>
  Keep your API keys secure and never expose them in client-side code or public repositories.
</Warning>

### Using bearer tokens

Include your bearer token in the Authorization header:

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET 'https://yourorg.proconvey.co.uk/api/v2/cases' \
    -H 'Authorization: Bearer YOUR_API_TOKEN'
  ```

  ```javascript Node.js theme={null}
  const response = await fetch('https://yourorg.proconvey.co.uk/api/v2/cases', {
    headers: {
      'Authorization': `Bearer ${process.env.API_TOKEN}`
    }
  });
  ```

  ```python Python theme={null}
  import requests

  headers = {
      'Authorization': f'Bearer {api_token}'
  }
  response = requests.get('https://yourorg.proconvey.co.uk/api/v2/cases', headers=headers)
  ```
</CodeGroup>

## Error handling

Common authentication errors and how to handle them:

<AccordionGroup>
  <Accordion title="401 Unauthorized">
    **Cause**: Invalid or missing authentication credentials

    **Solution**: Verify your API key is correct and included in the Authorization header
  </Accordion>

  <Accordion title="403 Forbidden">
    **Cause**: Valid credentials but insufficient permissions

    **Solution**: Check that your API key has the required scopes for the endpoint
  </Accordion>
</AccordionGroup>

## Best practices

<Tip>
  * Store API keys securely using environment variables or a secrets manager
  * Use the minimum required scopes for your integration
  * Regularly rotate your API keys
  * Never expose keys in client-side code or version control
</Tip>

## Testing authentication

You can test your authentication setup by making a request to the organisation endpoint:

```bash theme={null}
curl -X GET 'https://yourorg.proconvey.co.uk/api/v2/org' \
  -H 'Authorization: Bearer YOUR_API_TOKEN'
```

A successful response confirms your authentication is working and returns your organisation details.