# Authentication

URL: https://www.agencytitan.com/docs/tag/authentication

All `/v1` endpoints (except `/v1/openapi.json` and `/v1/llms.txt`) authenticate with a bearer token, sent as an `Authorization: Bearer <token>` header. Two credential types are **equal first-class paths**:

- **OAuth 2.0 access tokens** — issued through the OAuth authorization flow. Preferred by Claude.ai, ChatGPT, and other MCP hosts that discover OAuth automatically.
- **API keys** — start with `at_`, created under **Settings → System → API & MCP**. Preferred by Cursor, Claude Code, and clients that set request headers.

Each API key is assigned to a **service account**; every request executes as that service account, with its permissions, not as the person who created the key. OAuth 2.0 tokens act as the authenticated user instead. Keep credentials secret: never expose them in client-side code or public repositories.

Send the token as an `Authorization` header on every request:

```bash
curl https://api.agencytitan.com/v1/clients \
  -H "Authorization: Bearer at_your_api_key_here"
```

```javascript
const res = await fetch("https://api.agencytitan.com/v1/clients", {
  headers: { Authorization: "Bearer at_your_api_key_here" },
});
const data = await res.json();
```

```python
import requests

res = requests.get(
    "https://api.agencytitan.com/v1/clients",
    headers={"Authorization": "Bearer at_your_api_key_here"},
)
data = res.json()
```

```php
$ch = curl_init("https://api.agencytitan.com/v1/clients");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer at_your_api_key_here"]);
$data = json_decode(curl_exec($ch), true);
```

```ruby
require "net/http"
require "json"

uri = URI("https://api.agencytitan.com/v1/clients")
req = Net::HTTP::Get.new(uri)
req["Authorization"] = "Bearer at_your_api_key_here"
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }
data = JSON.parse(res.body)
```

A missing, invalid, expired, or revoked token returns `401` with an OAuth-style body:

```json
{
  "error": "invalid_token",
  "error_description": "The access token is invalid."
}
```

## Operations

_This tag has no REST operations (guide / concept page)._

## Useful links

- Interactive page: https://www.agencytitan.com/docs/tag/authentication
- API reference home: https://www.agencytitan.com/docs/
- This page as Markdown: https://www.agencytitan.com/docs/tag/authentication.md
- Full API Markdown: https://api.agencytitan.com/v1/llms.txt