This page is for Authlete 3.0. For 2.x, see Authentication (2.x) — 2.x uses API key and API secret (HTTP Basic auth) rather than Bearer tokens.
Authentication
All API endpoints are secured using Bearer token authentication. You must include an access token in every request:Getting your access token
Service Access Token
Scoped to a single service (one authorization server instance). Use it for runtime APIs (authorization, token, introspection) and for managing that service’s clients and settings. How to get a Service Access Token- Log in to the Authlete Console.
- Open the Organization that owns the service, then open the Service you want a token for.
- Go to Service → Settings → Access Tokens.
- Click Create Token and select the permissions you need (e.g.
service.read,client.write). - Copy the generated token immediately — it is shown only once. Store it in a secure place (e.g. environment variables or a secret manager).
Use this token in the Authorization: Bearer <token> header when calling Authlete APIs for that service.
Organization Token
Scoped to your entire organization. Use it for organization-level management and for APIs that operate across multiple services (e.g. automation, CI/CD, Terraform). How to get an Organization Token- Log in to the Authlete Console.
- Open the Organization you want a token for (or create one first).
- Go to Organization Settings → Access Tokens.
- Click Create Token and select the org-level permissions you need.
- Copy the generated token immediately — it is shown only once. Store it securely.
Use this token in the Authorization: Bearer <token> header when calling Authlete APIs that require organization-level access.
Which token to use
| Use case | Token type |
|---|---|
| OAuth/OIDC runtime (authorization, token, introspection) | Service Access Token |
| Managing a single service (clients, endpoints, config) | Service Access Token |
| Managing the organization or multiple services | Organization Token |
| Automation / CI/CD that creates or updates services | Organization Token |
Token security best practices
- Never commit tokens to version control — Store them in environment variables or a secure secret manager (e.g. AWS Secrets Manager, HashiCorp Vault).
- Rotate regularly — Generate new tokens periodically and revoke old ones from the console.
- Scope appropriately — Request only the permissions your application needs when creating a token.
- Revoke unused tokens — Delete tokens you are no longer using from the console.
Quick test
Verify your token works with a simple API call:us.authlete.com with your cluster host (e.g. eu.authlete.com, jp.authlete.com) if you use a different region.
Next steps
- Getting Started — Create an account, organization, and service.
- Using Demo Authorization Server — Create a service, generate a Service Access Token, and run a demo authorization server.
- Configuring client authentication — How your OAuth clients authenticate to your authorization server.