> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usecadence.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Sign in once, then send a bearer token with every call.

The API uses the same sign-in as the app. You sign in with your email and password, receive a session token, and send it as a bearer token.

## 1. Sign in

```bash theme={null}
curl -s "$CADENCE_URL/api/auth/sign-in/email" \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "YOUR_PASSWORD"}'
```

The response includes a `token` field. That value is your bearer token.

```json theme={null}
{
  "redirect": false,
  "token": "SIGNED_SESSION_TOKEN",
  "user": { "id": "...", "email": "you@example.com", "name": "..." }
}
```

> [!WARNING]
>
> A token is a full sign-in to your account. Keep it in a secret store, never in code or chat logs, and never share it.

## 2. Send it with each call

```bash theme={null}
curl -s "$CADENCE_URL/rpc/me" \
  -H "Authorization: Bearer $CADENCE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

`me` returns your account (`userId`, `email`, `name`) and the `spaceId` the call acted in. It is a good first call to check that the token works.

The token must be the signed value returned by sign-in. An unsigned session id is refused.

## 3. Sign out

Signing out ends the session, and the token stops working:

```bash theme={null}
curl -s -X POST "$CADENCE_URL/api/auth/sign-out" \
  -H "Authorization: Bearer $CADENCE_TOKEN"
```

## Accounts without a password

If you sign in with single sign-on or an emailed code, the email and password route above is not available to you. Use an account that has a password for scripted access.

## What a token can do

A token acts as you, in the space you choose with the `x-cadenceplus-space-id` header (or your default space). It can do exactly what you can do in the app, and nothing more:

* Members see the bots shared with them and their own settings.
* Owners and admins can also manage people and space settings.
* Nothing in the API grants server administration. Self-hosters change server settings in the server's environment, not through the API.

## Handling 401

A `401` with code `UNAUTHORIZED` means the token is missing, expired, signed out, or you were removed from the space. Sign in again to get a new token. See [Errors](https://docs.usecadence.gg/api/errors.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.