> For the complete documentation index, see [llms.txt](https://docs.samesystem.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.samesystem.dev/api-v1-reference/getting-authenticated.md).

# Getting authenticated

SameSystem API v1 supports OAuth 2.0 authentication. OAuth 2.0 is the recommended authentication method for all integrations.

API access requires a dedicated SameSystem API user. See [**API Access**](/getting-started/api-access.md) for information about requesting an API user.

The permissions assigned to the API user determine which data and operations the integration can access. API permissions follow the same permission model as the SameSystem web application.

### OAuth 2.0

SameSystem API v1 supports the following OAuth 2.0 grant types:

* **Resource Owner Password Credentials**
* **Refresh Token**

The API user's credentials are initially used to obtain an **access token** and a **refresh token**.

#### Get an Access Token

Authenticate using the API user and password provided by SameSystem and set the grant type to:

`grant_type=password`

A successful authentication returns:

* **Access token** – valid for 1 hour
* **Refresh token** – valid for 6 months

The access token is a **Bearer token**.

Include it in the `Authorization` header for subsequent API requests:

`Authorization: Bearer <access_token>`

The access token should be reused until it expires rather than requesting a new token for every API call.

See the [**Get Access Token**](/api-v1-reference/authentication/post-oauth-token.md) endpoint in the API v1 reference for request and response details.

### Refreshing an Access Token

After the access token expires, use the **Refresh Token** grant to obtain a new access token.

Use the same authentication endpoint and provide the refresh token instead of the API user's credentials:

```json
{
  "refresh_token": "<refresh_token>",
  "grant_type": "refresh_token"
}
```

Your integration should handle access token expiration and renewal automatically.

### Multiple clients

If you have multiple clients and one API user, you will need to login using the clientToken that belongs to the client where your API user is created.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.samesystem.dev/api-v1-reference/getting-authenticated.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.