---
title: "Authorisation / Authentication"
canonical: "https://support.soutron.net/space/LMSAPI/2228449/Authorisation%20%2F%20Authentication"
format: markdown
---
### Authorisation

Authorisation to the API is done using an API Key, this key is managed by Soutron not the customer.

The key can be passed in the http header or via cookie.

Name: **LmsApiToken**

Value (example) :**12CC1234-1234-123C-123C**


### Authentication

Authentication is done by passing an access token corresponding to an individual user this ensures queries performed with the users access token are done so with the correct permission. If no access token is specified in the request it will be performed with guest permissions. The access token should be sent in the Authorization header as a Bearer value. 


A Bearer value can be generated in several ways;

1. From the users account within the application.

![image](media://f6d6d6da-8fba-4181-b8b5-0b5e10eac045)

2. From ./Library/Management/Security/Authentication.aspx 

![image](media://98008dcc-6c4f-402a-9686-18f0cd3291d0)

2.1** Generate for Users with token** will re-generate tokens for all users who already has a token assigned.

2.2** Generate for users without** will generate a token for users currently without one assigned to their account, this will not re-generate tokens for users already with a token assigned.

2.3 **Generate for all users** will re-generate tokens already assigned and assign tokens to any user without one.


##### **Example ajax for setting authentication**

```javascript
var url = ' https://{client url}/soutronapi/catalogues';
                var userToken = "12CC1234-1234-123C-123C";
                $.ajax({
                    url: url,
                    success: function(json) {
                    },
                    error: function(XMLHttpRequest, textStatus, errorThrown) {
                    },
                    //headers: {'Authorization': 'Bearer 123abc456-12ab-1234-123'},
                    beforeSend: function (xhr) {
                        xhr.setRequestHeader("Authorization", "Bearer " + userToken);
                    },
                    type: 'GET',
                    contentType: 'application/json'
                }); 
```