> ## Documentation Index
> Fetch the complete documentation index at: https://docs.galadriel.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate your API requests with API tokens

# Authentication

The Galadriel API uses API tokens for authentication. Include your token in the `Authorization` header:

```http theme={null}
Authorization: Bearer YOUR_API_TOKEN
```

## Getting an API Token

1. Sign up at [https://app.galadriel.com](https://app.galadriel.com)
2. Navigate to Settings → API Tokens
3. Click "Create Token"
4. Copy and securely store your token

<Warning>
  Keep your API token secure. Do not share it or commit it to version control.
</Warning>

## Example Request

```bash theme={null}
curl https://api.galadriel.com/v1/orders \
  -H "Authorization: Bearer gal_abc123..."
```

## Token Permissions

Tokens can have different permission scopes:

| Scope          | Description                           |
| -------------- | ------------------------------------- |
| `orders:read`  | View orders and orderbook             |
| `orders:write` | Create and cancel orders              |
| `leases:read`  | View lease details                    |
| `leases:write` | Manage leases (terminate, resell)     |
| `full_access`  | All permissions (recommended for CLI) |

## Rotating Tokens

For security, rotate your tokens regularly:

1. Create a new token
2. Update your application to use the new token
3. Delete the old token

## API Token Format

Tokens are prefixed with `gal_` followed by a random string:

```
gal_1234567890abcdefghijklmnop
```

## Unauthorized Responses

If authentication fails, you'll receive a 401 response:

```json theme={null}
{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API token"
  }
}
```

Common causes:

* Missing `Authorization` header
* Invalid token format
* Expired or revoked token
* Insufficient permissions for the requested operation