Skip to main content
This page is for Authlete 3.0. For 2.x, see API Authentication (2.x) β€” 2.x uses API key and API secret (HTTP Basic auth) rather than Bearer tokens.

​
API Authentication

All API endpoints are secured using Bearer token authentication. You must include an access token in every request:
Authlete supports two types of access tokens: Service Access Token (scoped to a single service) and Organization Token (scoped to your entire organization). The sections below explain how to get each and when to use them.

​
Getting your access token

​
Service Access Token

Scoped to a single service (one authorization server instance). Use it for the Core API (authorization, token, introspection) and for managing that service’s clients and settings. How to get a Service Access Token
  1. Log in to the Authlete Console.
  2. Open the Organization that owns the service, then open the Service to view its Service Overview.
  3. Click Service Settings (next to Create Client). Service Overview page in the Authlete Console, with the Service Settings button highlighted
  4. On the General tab, scroll to Service Access Tokens, then click Create Token. Service Access Tokens section on the General tab, with the Create Token button and a token list showing a Permissions column
  5. In the dialog, set a token name and choose permissions β€” either a preset (Authorization Server for use_service, Resource Server for use_introspection, …) or individual permissions. See Permissions below. Add a Service Access Token dialog, showing the token name field and permission presets such as Authorization Server (use_service) and Resource Server (use_introspection)
  6. Click Create Token to generate it, then copy the token immediately β€” it is shown only once. Store it in a secure place (e.g. environment variables or a secret manager).
Use this token in the Authorization: Bearer <token> header when calling Authlete APIs for that service.

​
Organization Token

Scoped to your entire organization. An Organization Token carries the broadest access: with the right permissions it can call any API on any service in the organization β€” including the Core API β€” plus organization-level operations such as creating services and reading the organization audit log. It is typically used for organization-wide management and for automation that spans multiple services (e.g. CI/CD, Terraform). How to get an Organization Token
  1. Log in to the Authlete Console.
  2. Open the Organization you want a token for (or create one first).
  3. In the sidebar, open Organization Settings.
  4. On the General tab, scroll to Organization Access Tokens, then click Create Token. Organization Access Tokens section on the General tab, with the Create Token button and a token list showing a Permissions column
  5. In the dialog, set a token name and choose the org-level permissions you need β€” for example the Administrator preset (create_service, modify_service, view_audit_log) for CI/CD provisioning, or view_audit_log for read-only audit access. See Permissions below. Add an Organization Access Token dialog, showing the token name field and organization-level permission presets such as Administrator and Audit Reader
  6. Click Create Token to generate it, then copy the token immediately β€” it is shown only once. Store it securely.
Use this token in the Authorization: Bearer <token> header when calling Authlete APIs that require organization-level access.
Important: Tokens inherit the permissions of the account that creates them. Service tokens can only access their specific service. Organization tokens can access all services within your organization. Choose the token type and permissions that match what your application needs.

​
Which token to use

Based on the principle of least privilege, here is the recommended token type for each use case β€” pick the narrowest one that covers the job: For Core API calls, prefer a Service Access Token: it confines access to a single service, whereas an Organization Token would expose every service if it leaked. Reach for an Organization Token when the work genuinely spans multiple services or needs organization-level operations.

​
Permissions

Whichever token type you choose, the token carries fine-grained permissions that decide which Authlete APIs it can call β€” for example use_service for an authorization server that calls the Core API, use_introspection for a resource server, or create_client for provisioning. You pick these when you create the token, so grant only what the workload needs (least privilege). For the full list of permissions and the APIs each one allows, see Service Access Tokens in the developer guide.

​
Token security best practices

  • Never commit tokens to version control β€” Store them in environment variables or a secure secret manager (e.g. AWS Secrets Manager, HashiCorp Vault).
  • Rotate regularly β€” Generate new tokens periodically and revoke old ones from the console.
  • Scope appropriately β€” Request only the permissions your application needs when creating a token.
  • Revoke unused tokens β€” Delete tokens you are no longer using from the console.

​
Quick test

Verify your token works with a simple API call:
Use a Service Access Token for service-scoped endpoints or an Organization Token for org-scoped endpoints. Replace us.authlete.com with your cluster host (e.g. eu.authlete.com, jp.authlete.com) if you use a different region.

​
Next steps