> ## Documentation Index
> Fetch the complete documentation index at: https://developer.flabslis.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication APIs

> APIs for client authentication and token management

<img className="block dark:hidden" src="https://mintcdn.com/flabs/XMaScWewdN3WnYoT/logo/light.svg?fit=max&auto=format&n=XMaScWewdN3WnYoT&q=85&s=76bd6efd710b5d3a6017da1d7b459ed2" alt="Flabs Logo Light" width="166" height="40" data-path="logo/light.svg" />

<img className="hidden dark:block" src="https://mintcdn.com/flabs/XMaScWewdN3WnYoT/logo/dark.svg?fit=max&auto=format&n=XMaScWewdN3WnYoT&q=85&s=ce6b2e92330df479a4edd58d12660548" alt="Flabs Logo Dark" width="319" height="78" data-path="logo/dark.svg" />

## Overview

Flabs authentication APIs allow you to securely authenticate clients and manage tokens for API access.

<CardGroup cols={2}>
  <Card title="Generate Token" icon="key" href="/auth/endpoint/get_auth_token">
    Get auth tokens using client credentials
  </Card>

  <Card title="Refresh Token" icon="arrows-rotate" href="/auth/endpoint/get_auth_token_refresh">
    Refresh your auth token when it expires
  </Card>
</CardGroup>

## Authentication Flow

Our authentication system uses a two-token approach with a streamlined flow designed for security and efficiency:

<img src="https://mintcdn.com/flabs/XMaScWewdN3WnYoT/images/auth-flow.png?fit=max&auto=format&n=XMaScWewdN3WnYoT&q=85&s=909625228ce4fbffc18d5a76d875e8fc" alt="Authentication Flow Diagram" className="rounded-lg border" width="1409" height="1147" data-path="images/auth-flow.png" />

### Flow Breakdown

1. **Initial Authentication**: Use your Client ID and Client Secret to generate both an access token and refresh token
2. **Token Storage**: Store the refresh token securely in cache for future use
3. **API Access**: Use the access token (valid for 10 minutes) for all API requests
4. **Token Refresh**: When the access token expires, use the refresh token to generate a new access token without re-authentication
5. **Refresh Token Longevity**: The refresh token remains valid for 30 days of inactivity, eliminating the need for frequent re-authentication

### Key Benefits

* **Access Token**: Valid for 10 minutes, used for API requests
* **Refresh Token**: Expires after 30 days of inactivity; used to obtain new authentication tokens
* **Seamless Experience**: No need to repeatedly provide credentials once authenticated

<Note>
  All authentication tokens should be included in the Authorization header using
  the Bearer scheme.
</Note>

## Getting Started

To integrate with our authentication system:

1. Obtain client credentials (Client ID and Client Secret)
2. Generate an initial auth token using the [token endpoint](/auth/endpoint/get_auth_token)
3. Store both tokens securely
4. When the auth token expires, use the [refresh endpoint](/auth/endpoint/get_auth_token_refresh) to get the auth token again with logging again.