> ## Documentation Index
> Fetch the complete documentation index at: https://developers.askparable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API requests with workspace API tokens.

All API requests are authenticated with a bearer token in the
`Authorization` header:

```bash theme={null}
curl https://api.askparable.com/api/users/me \
  -H "Authorization: Bearer pat_..."
```

## API tokens

API tokens are long-lived credentials for programmatic access. They start
with the prefix `pat_`.

* **Issued per user.** Every token belongs to a named user in your
  workspace. Actions taken with a token are attributed to that user and
  governed by that user's roles and permissions.
* **Scoped to your workspace.** A token only reaches data and resources in
  the workspace it was issued for.
* **Shown once.** The token value is displayed a single time when it is
  created. Parable stores only a SHA-256 hash, so a lost token cannot be
  recovered, only replaced.
* **Revocable.** Tokens can be revoked at any time without affecting other
  tokens or the owning user's app access.

<Info>
  API tokens are currently provisioned by Parable for your workspace.
  Contact your Parable representative to request tokens for your team.
</Info>

## Sessions vs. tokens

Signing in to the Parable app creates a short-lived browser session. API
tokens exist so your scripts, services, and BI tools do not depend on a
browser session or its expiry. Use tokens for anything programmatic; use
the app for interactive work.

## Keeping tokens safe

* Store tokens in a secret manager, not in code or config files.
* Issue one token per integration so each can be revoked independently.
* Revoke tokens when a teammate leaves or an integration is retired.
* If a token leaks, revoke it immediately. Because only the hash is stored,
  revocation takes effect on the next request.

## Errors

| Status             | Meaning                                                                                           |
| ------------------ | ------------------------------------------------------------------------------------------------- |
| `401 Unauthorized` | The token is missing, malformed, revoked, or expired.                                             |
| `403 Forbidden`    | The token is valid but the owning user's roles do not cover the permission the endpoint requires. |