> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dabarai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authorize DABAR API requests with the api-token header. cURL, Node.js, and Python examples, plus error codes and token rotation guidance.

All DABAR API requests are authenticated with a token sent in the `api-token` HTTP header. Tokens are tied to a user and inherit that user's permissions and sources.

## Base URL

```
https://api.dabarai.com/v1
```

## Header

<ParamField header="api-token" type="string" required>
  The API token associated with your DABAR user account.
</ParamField>

## Example

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.dabarai.com/v1/politics \
    -H "api-token: YOUR_TOKEN"
  ```

  ```javascript Node.js theme={null}
  const res = await fetch("https://api.dabarai.com/v1/politics", {
    headers: { "api-token": process.env.DABAR_TOKEN }
  });
  const data = await res.json();
  ```

  ```python Python theme={null}
  import os, requests

  res = requests.get(
      "https://api.dabarai.com/v1/politics",
      headers={"api-token": os.environ["DABAR_TOKEN"]},
  )
  data = res.json()
  ```
</CodeGroup>

## Failure responses

| Status | Scenario                           |
| ------ | ---------------------------------- |
| `401`  | Header `api-token` is missing      |
| `401`  | Token does not match any user      |
| `403`  | Token lacks access to the resource |

## Keeping tokens safe

* Store tokens as environment variables or in a secrets manager — never in source control.
* Rotate tokens periodically and immediately if exposure is suspected.
* Use separate tokens per integration so you can revoke one without affecting others.