# Authentication (/docs/api/introduction/authentication)

> For the complete documentation index, see [llms.txt](https://docs.tandemcx.ai/llms.txt). Any page on this site can be fetched as Markdown by appending `.md` to its URL.

Every request to the Tandem API must be authenticated with a bearer token.

## Personal access tokens

A personal access token is a long-lived credential you create for yourself. It
authenticates API requests **as you**, in the organization you created it in, and
carries exactly the permissions your own account has — no more.

### Creating one

1. Open the user menu (your avatar, top right) and choose **Access Tokens**.
2. Select **Create Token**, then give it:
    - a **name** you'll recognize in the list (up to 40 characters),
    - an optional **description** of what it's for,
    - an **expiration** — 30, 60, or 90 days, 1 year, or no expiration.
3. Select **Create Token**.

Any member of an organization can create their own tokens; you don't need to be an
admin. You do need to be a current, active member: if you've been removed or disabled, or
your invitation is still pending, creating a token fails with `403` and `You are no longer
an active member of this organization`, even while you're still signed in.

<Callout type="warn">
    The token is shown **once**, on the screen that follows. Tandem stores only a hash of it and
    cannot display or recover it again. Copy it before you leave that screen. If you lose it, revoke
    the token and create a new one.
</Callout>

### Expiration

90 days is the default. An expired token stops authenticating and returns
`401 Unauthorized`; create a new one to replace it. **No expiration** is available
for the cases that genuinely cannot rotate, but a token with no expiry stays valid
until someone revokes it. Prefer a dated token.

### Revoking

Select the revoke action on any active token on the **Access Tokens** page. Revoking
takes effect immediately and cannot be undone — anything using that token stops
working. Revoked and expired tokens stay in the list so you can tell _why_ a token
stopped working rather than finding it gone.

Your tokens are also revoked automatically when you're removed from or disabled in the
organization. When an Owner disables you, your tokens in each of its sub-tenants that the
Owner also owns are revoked too. Being invited back doesn't restore a revoked token; create
a new one.

### Limits and rules

- You can hold up to **50 active tokens** per organization. Revoke one to create
  another.
- Tokens are scoped to a single organization — the one you were working in when you
  created the token.
- Tokens **cannot manage tokens**. Creating, listing, and revoking are browser-only
  operations, so a leaked token can't renew itself or lock you out of your own
  credentials.
- Treat a token like your password: never commit it to source control or paste it
  into a shared document.

## Authorization header

Send your token in the `Authorization` header on every request:

```http
Authorization: Bearer <token>
```

Requests are scoped to the organization the token belongs to. You can only read
and modify resources that belong to your organization.

## Example

```bash
curl https://api.tandemcx.ai/v1/workflows \
  -H "Authorization: Bearer <token>"
```

## Failed authentication

A missing, malformed, or expired token returns `401 Unauthorized` with the
standard [error envelope](/docs/api/introduction/error-handling):

```json
{
    "error": {
        "code": "UNAUTHORIZED",
        "message": "Authentication is required to access this resource."
    }
}
```

<Callout type="warn">
    In the interactive API playground, an invalid or expired token may appear as a network error
    rather than a clean `401` response. If a playground request fails without a status code,
    re-check that your bearer token is valid and current.
</Callout>

All traffic must use HTTPS; requests over plain HTTP are rejected.