> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firstresonance.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate against the ION GraphQL API: API keys for machine-to-machine integrations and OAuth 2.0 for user-facing applications.

## Authentication methods

The ION GraphQL API supports two authentication methods: **API keys** for machine-to-machine integrations and **OAuth 2.0** for user-facing applications. Both methods use your region's API endpoint and the same `Authorization` header. Only the way you obtain the token differs.

## Endpoint and headers

Include the access token on every request. `Host` is your region's API endpoint. For the endpoint that matches your app URL, see [Getting started](/getting-started/ion-basics#ion-environments).

```http theme={null}
POST /graphql HTTP/1.1
Host: api.buildwithion.com
Authorization: Bearer <token>
Content-Type: application/json
```

ION also accepts `Authorization: Token <token>` for backward compatibility. Prefer `Bearer`. For multipart file uploads, set `Content-Type: multipart/form-data`. Follow the flow in [File Upload](/api/guides/file-upload).

## Troubleshooting

When ION rejects a request during authentication, the response carries an `errors[].message` payload:

```json theme={null}
{
  "errors": [{ "message": "Token is expired." }]
}
```

For the full list of authentication failures and their fixes (`401 Unauthorized`, `403 Forbidden`, rate limits, and `5xx` errors), see [Error codes](/api/error-codes).

## Related

* [Manage API keys](/api/authentication/api-keys)
* [Authenticate with OAuth 2.0](/api/authentication/oauth)
* [Getting started](/api/getting-started)
* [Error codes](/api/error-codes)