> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Generate a Prizm API access token and use it to authenticate REST API requests.

<script type="application/ld+json">
  {`{
            "@context": "https://schema.org",
            "@type": "TechArticle",
            "headline": "Authentication",
            "description": "Generate a Prizm API access token and use it to authenticate REST API requests.",
            "url": "https://docs.dqlabs.ai/api-reference/authentication",
            "publisher": {
              "@type": "Organization",
              "name": "DQLabs Inc",
              "logo": "https://media.brand.dev/332adc35-5bc4-4d2b-bf78-256aa4a5e414.svg"
            }
            }`}
</script>

The Prizm REST API authenticates every request with a **bearer token** — a JWT you generate from your organization's settings.

<Warning>
  Prizm issues two distinct token types: **API access tokens** (for REST integrations like this API) and **MCP access tokens** (for MCP clients such as Claude Desktop or Cursor). They are not interchangeable — an MCP token will not authenticate REST API calls. This page covers API access tokens only.
</Warning>

## Generate a token

<Steps>
  <Step title="Open Access Tokens">
    In Prizm, go to **Settings → Organization → Access Tokens** and click **Add token**.
  </Step>

  <Step title="Configure the token">
    Set:

    * **Key alias** — a descriptive name, for example `reporting-integration`
    * **Generated for** — select **API**
    * **Expiry** — choose an appropriate expiration date
  </Step>

  <Step title="Copy the token">
    After creating the token, copy it from the table. For API tokens, this is a plain JWT string — copy it now, since it's shown only once.

    <Warning>
      Store the token as a secret (environment variable, secrets manager, or your platform's equivalent). Never commit it to source control.
    </Warning>
  </Step>
</Steps>

## Using the token

Send the token as a `Bearer` token in the `Authorization` header of every request. Do not send it as a custom header or query parameter.

```bash theme={null}
curl -X GET "https://<your-workspace>.prizmdata.ai/api/v1/core/asset/<assetId>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

| Header          | Value                                         |
| :-------------- | :-------------------------------------------- |
| `Authorization` | `Bearer <YOUR_API_TOKEN>`                     |
| `Content-Type`  | `application/json` (for requests with a body) |

## Generating a token via the API

You can also create an API access token programmatically, using an existing session or API token:

```http theme={null}
POST {baseUrl}api/v1/auth/access_token/
Authorization: Bearer <EXISTING_TOKEN>
Content-Type: application/json
```

```json theme={null}
{
  "key_alias": "reporting-integration",
  "generated_for": "API",
  "expired_at": "2027-01-01T00:00:00Z",
  "is_active": true,
  "purpose": "Reporting integration"
}
```

<Note>
  `generated_for` is what distinguishes an API token from an MCP token — always set it to `"API"` when generating a token for REST use.
</Note>

## Token reference

|                        | API access token                                              |
| :--------------------- | :------------------------------------------------------------ |
| **UI `generated_for`** | `API`                                                         |
| **JWT `token_type`**   | `api_access_token`                                            |
| **Purpose**            | REST API calls (this reference, Postman, custom integrations) |
| **Copied as**          | Plain JWT string                                              |
| **Auth header style**  | `Authorization: Bearer <jwt>`                                 |

## Token errors

| Response           | Cause                                                                       |
| :----------------- | :-------------------------------------------------------------------------- |
| `401 Unauthorized` | Token missing, expired, or revoked                                          |
| `401 Unauthorized` | An MCP token (`token_type: mcp_authorization`) used against a REST endpoint |

<Note>
  A complete list of error response shapes and codes is still being documented — see [Response & Error Format](/api-reference/response-format) for what's confirmed so far.
</Note>