# Authentication

Send a Foxora account access token as an HTTPS Bearer credential and validate it against `/v1/me` before enabling account-dependent work.

```bash
export FOXORA_ACCESS_TOKEN='<account-access-token>'

curl https://api.foxora.ai/v1/me \
  -H "Authorization: Bearer $FOXORA_ACCESS_TOKEN"
```

1. Obtain the token through a supported Foxora authentication or client flow.
2. Store it outside source code and client-side bundles.
3. Send `Authorization: Bearer …` on every protected request.
4. Treat `401 UNAUTHORIZED` as missing, expired, or invalid authentication.
5. Revoke the associated session and replace the token after suspected exposure.

Foxora does not currently present self-service long-lived user API keys as a public product surface. Never copy internal service credentials from application storage.

**Expected result:** the request returns the correct account identity; an absent or invalid token returns `401` without exposing account data.