# Authentication

> Authenticate to the Flax API with service-account tokens (flax_pat_…) carrying read and write scopes

*[View this page in the Flax docs](https://flax-analytics.com/docs/developers/authentication)*

Programmatic access to the Flax API uses **API tokens** held by **service accounts**. A service account is a non-human principal you assign to teams so it can see the data you want; a token is the secret it authenticates with. This page is for developers wiring up scripts, jobs, or MCP clients.

## Service accounts and tokens

- Create a service account, then issue one or more tokens for it on the API access page at [/app/settings/api](/app/settings/api).
- A token secret looks like `flax_pat_…` and is shown **once** at creation — store it securely.
- Assign the service account to [teams](/docs/administration/teams-and-rbac) so it inherits the data access you intend. A token never grants more than its service account can see.

## Scopes

Each token carries one or both scopes:

| Scope | Grants |
| --- | --- |
| `read` | List and read models, connections, charts, dashboards, and run queries |
| `write` | Create and update charts, sheets, and dashboards |

Pick the narrowest scope that fits the job. A read-only automation should never hold a `write` token.

## Making a request

Send the token in the `Authorization` header as a bearer credential:

```bash
curl https://flax.example.com/api/projects \
  -H "Authorization: Bearer flax_pat_xxx"
```

Every request is additionally constrained by the service account's team membership and row-level security — the token adds no privilege of its own.

> [!WARNING]
> Treat `flax_pat_…` tokens like passwords. Keep them out of source control and rotate them by revoking and reissuing on the API access page.

## Next steps

- [OAuth for MCP clients](/docs/developers/oauth)
- [Local MCP server](/docs/developers/mcp-local)
- [API reference](/docs/api-reference/overview)