> ## Documentation Index
> Fetch the complete documentation index at: https://developers.parkes.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate with a bearer token scoped to one organization.

Send your credential in the `Authorization` header on every resource request:

```http theme={null}
Authorization: Bearer <token>
```

The API accepts OAuth access tokens and personal tokens. Signing into the Parkes website does not authenticate REST requests; browser session cookies are not API credentials.

## Choose a credential

**OAuth access tokens** represent an authorized grant. Parkes' CLI and iOS app use OAuth to sign you in and select an organization. Keep refresh tokens in secure storage and use the supported client's refresh flow.

**Personal tokens** support scripts and unattended tasks. Manage them through **API access** in your Parkes profile settings. Choose only the scopes your task needs and store the returned secret securely; the secret is shown only when issued. Revoke tokens that are no longer needed.

Personal tokens have additional restrictions for unattended Knowledge writes: they can write only to your own namespace.

## Organization access

Each grant and token belongs to exactly one organization, selected during authorization. The server derives the organization from the credential, so resource requests do not take an organization-selection header or a repeated organization ID in the route.

For example, both organizations use `GET /rest/v1/skills`. The token determines which organization's skills are returned. Authorize each additional organization separately, then switch credentials in your client.

Use `GET /rest/v1/me` to inspect the authenticated identity and organization. An organization ID that identifies a resource is not a way to switch the token's organization.

## Scopes and permissions

Scopes limit what the credential may do. They do not grant ownership, organization membership, or administrator rights. Requests must satisfy both the credential's scopes and your current permissions.

Each endpoint documents its required scopes. A `401` response indicates an authentication failure; a `403` response means the request is not permitted. See [errors](https://developers.parkes.ai/ERRORS.md) for how to handle these responses.

## Keep credentials private

Use HTTPS and send tokens only to the API origin. Do not place tokens in URLs, checked-in configuration, or logs. The API does not redirect resource requests to another host.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.