> For the complete documentation index, see [llms.txt](https://developers.docstudio.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers.docstudio.com/introduction/authentication-and-application-tokens.md).

# Authentication and Application tokens

This document explains how to authenticate DocStudio API requests with application and temporary authorization tokens.

{% hint style="info" %}
Use application tokens for server-side integrations, backend services, automation, and long-running API access. Use `/api/login` for testing or short-lived sessions that require user credentials.
{% endhint %}

### Choose a token type

| Token type                    | Use for                                                                             |
| ----------------------------- | ----------------------------------------------------------------------------------- |
| Application token             | Server-side integrations, backend services, automation, and long-running API access |
| Temporary authorization token | Testing, short-lived sessions, or requests that use user credentials                |

### Authentication header

Use the same header format for both token types.

```
Authorization: Bearer {token}
```

The token identifies the caller. Endpoint permissions still control access to a mailbox, account, envelope, template, dictionary, domain, or attachment.

### Manage application tokens

Use application tokens without sending a user password in every request. Store them only in secure server-side storage.

Do not expose token values in client-side code, mobile applications, repositories, logs, screenshots, tickets, shared documents, or frontend environment variables.

Application token endpoints return an application token object.

#### List application tokens

| Method | Endpoint        |
| ------ | --------------- |
| `GET`  | `/api/v1/token` |

**Response**

Returns an array of application token objects.

#### Create application token

| Method | Endpoint        |
| ------ | --------------- |
| `POST` | `/api/v1/token` |

**Request body**

```json
{
  "name": "string",
  "expireAt": "2026-07-21T13:42:40.621Z"
}
```

| Field      | Type      | Required | Description                    |
| ---------- | --------- | -------- | ------------------------------ |
| `name`     | string    | Yes      | Application token name         |
| `expireAt` | date-time | Yes      | Token expiration date and time |

**Response**

Returns an application token object. Copy and store the returned token value securely.

#### Revoke application token

| Method   | Endpoint             |
| -------- | -------------------- |
| `DELETE` | `/api/v1/token/{id}` |

**Path parameters**

| Parameter | Type | Required | Description          |
| --------- | ---- | -------- | -------------------- |
| `id`      | UUID | Yes      | Application token ID |

**Response**

Returns `200 OK`.

#### Configuration restriction

Application token methods can be disabled by configuration. The API then returns `405 Method disabled by configuration`.

```json
{
  "code": 0,
  "message": "string",
  "messageLocalized": "string",
  "messageArgs": [
    "string"
  ],
  "data": "string"
}
```

| Field              | Type    | Description                                 |
| ------------------ | ------- | ------------------------------------------- |
| `code`             | integer | Error code                                  |
| `message`          | string  | Error message                               |
| `messageLocalized` | string  | Localized error message                     |
| `messageArgs`      | array   | Dynamic arguments used to build the message |
| `data`             | any     | Additional error data                       |

{% hint style="info" %}
This response schema applies to disabled application token methods only.
{% endhint %}

### Temporary authorization tokens

Use `/api/login` to get a temporary authorization token with user credentials. The token expires after 3 hours.

Use application tokens for long-running integrations.

| Method | Endpoint     |
| ------ | ------------ |
| `POST` | `/api/login` |

#### Request body

```json
{
  "login": "string",
  "password": "string"
}
```

| Field      | Type   | Required | Description   |
| ---------- | ------ | -------- | ------------- |
| `login`    | string | Yes      | User login    |
| `password` | string | Yes      | User password |

#### Response

```json
{
  "token": "string",
  "deviceId": "string"
}
```

| Field      | Type   | Description                                |
| ---------- | ------ | ------------------------------------------ |
| `token`    | string | Temporary authorization token              |
| `deviceId` | string | Device ID returned with the login response |

Use the returned `token` value in the `Authorization` header.

```
Authorization: Bearer {authorization-token}
```

### Resolve authentication and access errors

| Code                      | Meaning                                              | Action                                                             |
| ------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------ |
| `401 Not authorized`      | The request is not authenticated                     | Check the header, token value, and token expiration                |
| `403 Forbidden`           | The token cannot access the resource or action       | Check access to the required account, mailbox, or requested object |
| `90035 Not a token owner` | The current user cannot access the application token | Use a token from the correct user and account                      |

### Checklist

1. Confirm that the `Authorization` header uses the `Bearer {token}` format.
2. Confirm that the token value is valid and has not expired.
3. Confirm that the token and requested resource use the expected account and mailbox.

### How to respond to an exposed token

1. Stop using the exposed token.
2. Create a new token and update the integration.
3. Revoke the exposed token and remove it from unsafe locations.

### Related topics

* [API token security](/introduction/api-token-security.md)
* [Send your first envelope](/introduction/send-your-first-envelope.md)
* [Authorization](/api-reference/authorization.md)