> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apowerb.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Obtaining and using a token.

All endpoints except health, config and provider callbacks require a bearer token.

## Getting a token

```bash theme={null}
curl -X POST https://YOUR_DOMAIN/api/auth/token \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "..."}'
```

Use it on every subsequent call:

```
Authorization: Bearer <token>
```

Tokens are signed with `ENCRYPT_KEY` and expire after `ACCESS_TOKEN_EXPIRE_MINUTES`
(120 by default). Refresh with `POST /api/auth/refresh-token`; `POST /api/auth/logout`
clears the refresh cookie.

## Account lifecycle

| Method | Endpoint                        | Description                        |
| ------ | ------------------------------- | ---------------------------------- |
| POST   | `/api/auth/forgot-password`     | Start a password reset             |
| POST   | `/api/auth/reset-password`      | Complete it with the emailed token |
| POST   | `/api/auth/verify-email`        | Confirm an address                 |
| POST   | `/api/auth/resend-verification` | Send the confirmation again        |

## What is not here

Two things belong to commercial editions and are **absent** from this build:

* **Signing in with an identity provider** — GitHub, Google, Microsoft, LinkedIn. The
  open-source core authenticates with email and password only.
* **Multi-factor authentication.** `/api/auth/mfa/*` does not exist; it answers `404`.

See [Editions](/concepts/editions). Do not read those `404`s as a missing object —
they mean the capability is not in this edition.

<Warning>
  `ENCRYPT_KEY` signs tokens. If it is empty, token verification degenerates: a required
  secret that receives an empty string can make forged tokens acceptable. Refuse to boot
  without it rather than defaulting it.
</Warning>


## Related topics

- [th2etl](/ecosystem/th2etl.md)
- [Production notes](/self-hosting/production.md)
- [Rag Stream](/api-reference/rag/rag-stream.md)
- [Editions and extensions](/concepts/editions.md)
- [Get Adk App Info](/api-reference/get-adk-app-info.md)