# Authentication

[Open in the interactive reference](https://docs.api.lensing.ai/?op=guide%3Aauth)

Authenticate every request with an access token, sent as a bearer token in the `Authorization` header. [Access tokens](https://docs.api.lensing.ai/api/app/uiengine/static/content-isolation-assets/guides/tokens.html) explains how to create one and grant it access.

Two statuses report a problem with the token:

- `401`: the request carries no valid access token, for example because the token is missing, expired or revoked.
- `403`: the token is valid but has not been granted this endpoint.

Neither response carries an error `code`, so branch on the status. The body of a `401` also differs from every other failure: its `error` is a string, not an object.

Webhook deliveries work the other way round: the platform signs them, and your endpoint verifies the signature. See [Webhooks](https://docs.api.lensing.ai/api/app/uiengine/static/content-isolation-assets/guides/webhooks.html).

## Examples

**A refused token**

```
HTTP/1.1 401 Unauthorized

{ "error": "401 Unauthorized - …" }
```