---
agentTools:
  projectIndex: https://docs.wiboor.com.br/llms.txt
  projectSearch: https://docs.wiboor.com.br/agentSearch?query=term1%20term2
---

# Authentication

Generate the API token in Wiboor and send it in every request

The Wiboor API uses a **Bearer token**. Each token belongs to a user: the API sees and changes what that user can see and do in Wiboor.

## Generate your token

1. Sign in at [wiboor.com.br](https://wiboor.com.br/login).
2. Click your profile button (the last one in the side panel) and choose **Token**.
3. Click **Gerar Token** (Generate token) and copy the token shown.

> ⚠️ The token is shown only once
>
> Keep it somewhere safe, such as your server's secret store. If you generate a new token, the previous one stops working immediately.

## Send the token in your requests

Include the token in the `Authorization` header of every call:

```bash Terminal
curl "https://api.azzimuti.com.br/v1/departments" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"
```

| Header | Value |
|---|---|
| `Authorization` | `Bearer YOUR_TOKEN` |
| `Content-Type` | `application/json` (on requests with a body) |

In the [API reference](/reference/listar-todas-as-tarefas-com-filtros), paste the token into the authentication field to try the calls right on the page.

> ⚠️ The Try It token is saved in this browser
>
> So you don't have to paste it again, the token you type in the reference is stored in the browser. Only test on your own computer, never on a shared one.

## Authentication responses

| Status | When it happens |
|---|---|
| `401` | Missing, invalid or revoked token (for example, after generating a new one) |
| `403` | The token is valid, but the user is not allowed to perform the action. Example: only the task's requester or a manager can edit it |

## Good practices

- Use the token only in your backend. Never put it in code that runs in the browser or in the user's app.
- Create an integration user in Wiboor when tasks should show up as opened by the system rather than by a person.
- When you rotate the token, update every system that uses the old one.