# Authentication

All our API endpoints are protected and require authentication. If you already registered your application, you can find it in [Monta Hub](https://hub.monta.app/profile/applications).

## Access Token

To obtain your access token - needed for all subsequent requests - you have to call our [/auth/token](/api/authentication#obtain-your-accesstoken) endpoint and provide your `clientId` and `clientSecret`.

If your request was successful, you'll receive a response like this:

```json
{
    "applicationId": 1,
    "userId": 1,
    "accessToken": "dba896fe-8f14-46bd-89ac-4270091e9db1",
    "accessTokenExpirationDate": "2023-05-10T17:35:31.703819Z",
    "refreshToken": "8f449e8c-864e-4bbc-a328-aa3ad876351b",
    "refreshTokenExpirationDate": "2023-06-09T16:35:31.703832Z"
}
```

For subsequent requests, you have to use the `accessToken` for authentication. Pass it to the `Authorization` header as **Bearer token**:

**Example:** `Authorization: Bearer 4596d494-5f6c-4f87-aed5-db68240a58dd`

:::tip{title="Make use of Refresh Token flow!"}

As you can see the `accessToken` will expire within 1 hour. To protect your `clientId` and `clientSecret` you should make use of the `refreshToken` and Refresh Token flow to obtain a new one.

:::

## Refresh Token flow

To refresh your access token you have to call our [/auth/refresh](/api/authentication#obtain-your-accesstoken-with-a-refreshtoken) endpoint and provide your `refreshToken`.

If your request was successful, you'll receive a new set of access and refresh tokens:

```json
{
    "applicationId": 1,
    "userId": 1,
    "accessToken": "495f55a3-f66c-4d30-be0a-3286724b5854",
    "accessTokenExpirationDate": "2023-05-10T17:36:19.557794Z",
    "refreshToken": "1fbca567-9d67-4a02-a59e-17ade68a8f7e",
    "refreshTokenExpirationDate": "2023-06-09T16:36:19.557808Z"
}
```

## Information about current application

You can use the [/auth/me](/api/authentication#obtain-information-about-current-application) endpoint to receive information about the scope etc for the given application. A sample response looks like this:

```json
{
    "id": 1,
    "userId": 1,
    "name": "Public Api Demo",
    "clientId": "2cae3a14-3dfd-414b-8965-7814370ec324",
    "clientSecret": null,
    "scopes": [
        "all"
    ],
    "createdAt": "2023-05-04T14:29:06Z",
    "updatedAt": "2023-05-04T14:29:06Z"
}
```

This credential has access to all resources from the User with id `1`.