> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.aurasos.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.aurasos.com/_mcp/server.

# Authentication

AURA authenticates every request with a **bearer token** (a JWT) generated from
your `clientId` and `clientSecret`. These credentials identify your integration
— your *customer source* — and must only ever be used from a backend.

## How it works

1. Exchange your server credentials for a bearer token.
2. Send that token in the `Authorization` header on every request.
3. Request a new token when the current one expires.

```mermaid
flowchart LR
    A["POST /panic-api/v2/oauth/token"] --> B{Authorised?}
    B -- No --> E["401 Unauthorized"]
    B -- Yes --> C["200 — bearer token granted"]
```

For the exact request and response, see
[Exchange credentials for a token](/api-reference/authentication/create-oauth-token)
in the API Reference. A [callout-scoped token](#token-types) adds a customer
lookup — an unknown `customerId` returns `404`.

## Token types

* **Server token** — for backend integrations. Carries the full access of your
  customer source.
* **Callout-scoped token** — a narrower token limited to a single customer's
  callout flow. Use it for sessions that should not carry full access. A
  callout-scoped token is **rejected with `401`** on any endpoint outside the
  callout flow. See
  [Create a callout-scoped token](/api-reference/authentication/create-callout-token).

## Token lifetime

Token lifetime is fixed per customer source and returned as `expiresIn`
(seconds). It is not a request parameter — it can only be changed by the AURA
engineering team on request. Refresh by requesting a new token rather than
creating one per request, and never expose credentials or tokens in client
applications.

> **Note**
>
> If your integration needs a different lifetime cadence, contact the AURA engineering team.