> ## Documentation Index
> Fetch the complete documentation index at: https://docs.natecosmic.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access tokens

> Bearer credentials for COSMIC API requests, including OAuth and personal access tokens.

An **access token** is a short-lived **credential** your app sends on COSMIC API requests.

Send it in the `Authorization` header on each request:

```bash theme={null}
Authorization: Bearer <access_token>
```

## Token types

<Tabs>
  <Tab title="OAuth">
    OAuth apps receive access tokens after the user authorizes your app and the authorization code is exchanged at the token endpoint.

    For **public clients** (for example browser SPA or mobile apps), PKCE is required and the code exchange can be done by the client without a `client_secret`.

    For **confidential clients** (apps with a trusted backend), the backend performs the code exchange using the app's configured client authentication method.

    OAuth responses usually include a **refresh token** and **`expires_in`** (seconds until the access token expires).

    When an OAuth access token is near expiry or already expired, request a new one with **`grant_type=refresh_token`** so the user does not need to repeat the browser authorization flow.

    See [OAuth](/guides/oauth) for the refresh request, client authentication, and error handling.
  </Tab>

  <Tab title="Personal access tokens">
    Personal access tokens are generated in the{" "}
    <a href="https://natecosmic.com/developers/access-tokens" rel="noopener noreferrer" target="_blank">developer portal</a> for your own account. They are best for prototyping, tests, and one-off scripts.

    They **expire after one hour**. When one expires, create another in the portal if you still need a personal token.

    For anything that runs as other users or in production, use [OAuth](/guides/oauth).

    <Warning>
      Treat access tokens as secrets. Never commit them to source control.
    </Warning>
  </Tab>
</Tabs>

## Confirming access with `GET /v1/me`

After you obtain a token, call **`GET /v1/me`** with the same `Authorization` header you use for other API calls. The response includes the signed-in **`user`** and, for OAuth integration tokens, the **`scopes`** array (COSMIC API permissions on that access token).

To list **organizations** and **members**, use **`GET /v1/organizations`** and **`GET /v1/organizations/{organization_id}/organization-members`** with the appropriate scopes—not `GET /v1/me`.

See [Authorization](/concepts/authorization) for how access is decided beyond scopes alone.

## Related

* [OAuth](/guides/oauth)
* [Authorization](/concepts/authorization)
* [Scopes](/concepts/scopes)
* [API reference](/api-reference/api)