# Authentication

> Send your API token as a Bearer token in the Authorization header.

![](https://developers.mothership.com/images/authentication.svg)

## API tokens

The Mothership API uses tokens to authenticate requests. Organization owners create tokens on the [API settings page in the dashboard](https://dashboard.mothership.com/settings/api). Sandbox and production tokens are separate, and each environment can have two active tokens at a time, so you can switch to a new token before you revoke the old one.

If the API page isn't in your dashboard settings, your organization doesn't have API access yet. Reach out to [developers@mothership.com](mailto:developers@mothership.com), and a member of our developer relations team will be in touch to set up access and help with onboarding.

> [!WARNING]
> API tokens act as passwords for the Mothership API and should be stored securely. Keep them out of source control and client-side code.

## Authorization header

To authenticate a request, include your API token as a `Bearer` token in the request's `Authorization` header.

```curl
curl --request GET \
  --url https://api.mothership.com/beta/shipments/MS5016101 \
  --header "Authorization: Bearer $MOTHERSHIP_API_TOKEN" \
  --header 'Content-Type: application/json'
```

Unauthenticated requests will fail with a `401` response code.

```json Unauthenticated 401 Response
{
  "code": 401,
  "type": "UNAUTHENTICATED",
  "message": "Unauthorized"
}
```

A token that is valid but lacks permission for an endpoint gets a `403` with the type `MISSING_PERMISSION`. See [Error handling](https://developers.mothership.com/reference/error-handling).