# Authentication

## Authentication
Requests carry a bearer token that an admin of your organisation creates
under **Settings → Integrations → For developers → SCIM provisioning → Provisioning tokens**:

```
Authorization: Bearer scim_live_<token>
```
A token belongs to exactly one organisation and only ever acts on that
organisation's users and groups. It is shown once when it is created —
store it in your identity provider straight away. You choose how long it
runs (one year by default). To rotate, create a new token while the old
one stays valid, switch your identity provider to it, then revoke the
old one on the same page. A revoked or expired token fails on the next
request.
Every authentication failure returns the same `401` with
`WWW-Authenticate: Bearer realm="scim"`.

Version: 1.79.2

## Description:

  - `Authentication` ()
    Requests carry a bearer token that an admin of your organisation creates
under **Settings → Integrations → For developers → SCIM provisioning → Provisioning tokens**: ```
Authorization: Bearer scim_live_<token>
``` A token belongs to exactly one organisation and only ever acts on that
organisation's users and groups. It is shown once when it is created —
store it in your identity provider straight away. You choose how long it
runs (one year by default). To rotate, create a new token while the old
one stays valid, switch your identity provider to it, then revoke the
old one on the same page. A revoked or expired token fails on the next
request.
Every authentication failure returns the same `401` with
`WWW-Authenticate: Bearer realm="scim"`.