---
title: "API Authentication | Gazebo Docs"
description: "Choose the right Gazebo bearer token for account administration or scoped agent credential access."
url: "https://gazebohq.com/docs/api/authentication"
---

The Gazebo REST API uses bearer tokens. Gazebo issues two different token types for two different jobs:

| Token | Used for | Accepted by |
|---|---|---|
| **Account API token** | Trusted automation across your Gazebo account | Supported `/api/v1` account administration endpoints |
| **Agent token** | Scoped credential access for one agent | `/api/agents/*` and `/api/mcp` |

Tokens are not interchangeable. An agent token cannot access `/api/v1`, and an account API token cannot retrieve credentials through the agent REST API or the MCP `get_credential` tool.

## Authorization header

Include the appropriate token in every request:

```
Authorization: Bearer YOUR_TOKEN
```

## Account API tokens

Generate an account API token in **Settings**. Generating a replacement revokes the previous account token.

Account API tokens have broad authority. Store them as secrets and use them only in trusted server-side automation, scripts, and CI systems.

```bash
curl https://app.gazebohq.com/api/v1/agents \
  -H "Authorization: Bearer YOUR_ACCOUNT_API_TOKEN"
```

The reference documents the `/api/v1` endpoints Gazebo supports for external use. Account API tokens are rejected on other `/api/v1` routes, including notification preferences, LTD claims, login routes, and account-token generation.

Verify a token and identify its account with:

```bash
curl https://app.gazebohq.com/api/v1/me \
  -H "Authorization: Bearer YOUR_ACCOUNT_API_TOKEN"
```

Account API tokens cannot rotate themselves. Generate or replace the token from the signed-in Gazebo dashboard.

## Agent tokens

An agent token belongs to one agent and is constrained by that agent's service and HTTP-method access policy. The token is shown once when the agent is created.

```bash
curl "https://app.gazebohq.com/api/agents/me/credentials/stripe?method=GET" \
  -H "Authorization: Bearer YOUR_AGENT_TOKEN"
```

Revoking the agent immediately invalidates its token without rotating the underlying service credentials.

See [Bearer tokens](/docs/bearer-tokens) for the agent-token lifecycle and [Agent credential access](/docs/api/agent-access) for the REST contract.

## Browser sessions

The Gazebo dashboard also calls `/api/v1` using its signed-in browser session. Browser sessions are not an API authentication method for external integrations.

## Agent Consent Flow

Agent Consent Flow has its own authorization, token exchange, introspection, and revocation flow. Its tokens are not account API tokens or agent tokens. See the dedicated [Agent Consent Flow integration guide](/docs/consent).