> ## Documentation Index
> Fetch the complete documentation index at: https://api.docs.originone.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate to the Origin One API with a bearer API token.

The Origin One API authenticates every request with an API token passed as a bearer token in the `Authorization` header.

## Get an API token

Please request your API Key.

When your token is created, it is configured with:

* **A tenant** — your organization on the Origin One platform.
* **Companies** — the specific companies the token can access. All data returned by the API is scoped to these companies.
* **Scopes** — the operations the token is allowed to perform. See [Scopes](/scopes).

## Authenticate requests

Pass the token in the `Authorization` header of every request:

```bash theme={null}
curl https://api.origin.one/api/v2/locations \
  --header "Authorization: Bearer $ORIGIN_ONE_API_TOKEN"
```

## Authentication errors

| Status | Meaning |
| - | - |
| `401 Unauthorized` | The token is missing, invalid, expired, or lacks a required scope. |
| `403 Forbidden` | The token is valid but the requested resource is outside its access (for example, a location that belongs to a company the token is not linked to). |
| `404 Not Found` | Some endpoints return 404 instead of 403 to avoid revealing whether a record exists. |

## Token security

* Never embed tokens in client-side code, mobile apps, or public repositories.
* Store tokens in a secrets manager or environment variables, not in source control.
* Request separate tokens per integration so access can be revoked independently.
* If a token is compromised, contact Origin One immediately to revoke it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.