# Authentication The REST API and any programmatic/AI-agent access use a **personal API token** (Laravel Sanctum). You send it as a bearer token on every request. ## Create a token 1. Sign in and go to **Settings → API Tokens**. 2. Click **Create token**, give it a name, and copy the value. 3. Store it somewhere safe — it's shown **only once**. ## Use the token Send it in the `Authorization` header, and always ask for JSON: ```bash curl https://dev.dbmigratepro.com/api/user \ -H "Authorization: Bearer YOUR_TOKEN" \ -H "Accept: application/json" ``` A valid token returns your user object. A missing or invalid token returns `401 Unauthorized`. ## Base URL All API endpoints are under: ``` https://dev.dbmigratepro.com/api ``` ## Notes - Tokens are scoped to your account — a migration you create belongs to your team, and only members of that team can read, retry, or delete it. (Solo accounts are just a team of one.) - Revoke a token anytime from **Settings → API Tokens**; it stops working immediately. - Keep tokens server-side. Never embed one in client-side JavaScript or a public repo.