# Authentication

Send a Foxora account access token as an HTTPS Bearer credential and validate it against /v1/me before enabling account-dependent work.

Terminal



```
export FOXORA_ACCESS_TOKEN='<account-access-token>'

curl https://api.foxora.ai/v1/me \
  -H "Authorization: Bearer $FOXORA_ACCESS_TOKEN"
```




- Obtain the token through a supported Foxora authentication or client flow.

- Store it outside source code and client-side bundles.

- Send `Authorization: Bearer …` on every protected request.

- Treat `401 UNAUTHORIZED` as missing, expired, or invalid authentication.

- Revoke the associated session and replace the token after suspected exposure.




Foxora does not currently present self-service long-lived user API keys as a public product surface. Never copy internal service credentials from application storage.




**Expected result:** the request returns the correct account identity; an absent or invalid token returns `401` without exposing account data.

Source: https://www.foxora.ai/docs/ko/api/authentication