# Authentication

SecuriThings API uses the OAuth 2.0 protocol with JWT for authentication and authorization.

Each request made to our API requires a Bearer token in the Authorization header.<br/>
This token is a JWT containing information about the user and their permissions.

## Getting credentials for the API

Each integration with the SecuriThings API requires a set of credentials. These credentials are used to generate a JWT token that is used to authenticate the user across the API.

Credentials are provided manually by the SecuriThings team. To get your credentials, please [contact our support team](https://forms.gle/og4uornuwain2jhSA).

Credentials are composed of three parts:

- `organization`: The tenant that the client belongs to.
- `client_id`: A unique identifier for the client.
- `client_secret`: A secret key that is used to generate the JWT token.

## Getting a token

Using the credentials provided by the SecuriThings team, you can generate a JWT token by sending a POST request to the `/v1/auth/<organization>` endpoint.

`client_id` and `client_secret` should be provided using Basic Authentication.

:::caution

Running these commands will expose your credentials in the terminal history.

Make sure to clear the terminal history after running the commands or opt to use an API client.

:::

```bash
curl -X POST https://api.securithings.com/v1/auth/<organization> \
     -H 'Content-Type: application/json' \
     -H 'Authorization : Basic <base64(client_id:client_secret)>'

# or

curl -X POST https://api.securithings.com/v1/auth/<organization> \
     -H 'Content-Type: application/json' \
     -u '<client_id>:<client_secret>'
```

A token is valid for one hour by default. Generate a new token after it expires.

:::note

A `refresh_token` is not provided by default. If you require one, please contact our
[support team](mailto:cs_engineers@securithings.com).

:::

## Using Postman or Insomnia

Setup instructions for both clients, and a downloadable Postman Collection that includes the
authentication setup, are on the [Postman & Insomnia](/resources/postman) page.