# Setting up authentication

> Create a sandbox token and send it with every request in this guide.

![](https://developers.mothership.com/images/authentication.svg)

As outlined in the [authentication reference docs](https://developers.mothership.com/reference/authentication), the Mothership API handles authenticating requests via a `Bearer` token in the request's `Authorization` header.

For the purposes of this guide, use a sandbox token so nothing you book is real. Create one on the [API settings page in the dashboard](https://dashboard.mothership.com/settings/api), then put it in an environment variable. The examples in this guide read it from there.

```shell
export MOTHERSHIP_API_TOKEN="your sandbox token"
```

Every request you make in the sandbox environment must include this token in the `Authorization` header.

```http
Authorization: Bearer {API_TOKEN_GOES_HERE}
```

> [!NOTE] The shared sandbox token is retired
> Earlier versions of this guide used one generic token for everyone. The sandbox now takes your organization's own sandbox token, and the generic token is rejected with a `401`.

For production requests, create a production token on the same [API settings page](https://dashboard.mothership.com/settings/api).