> ## Documentation Index
> Fetch the complete documentation index at: https://docs.visotrust.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate requests to the VISO TRUST API with a bearer token generated from your user profile, including header format and base URL.

The VISO TRUST API uses bearer token authentication. Every request must include an API token in the `Authorization` header. Requests without a valid token are rejected.

## Base URL

All endpoints are served from:

```
https://app.visotrust.com
```

Each path in this reference is appended to that base URL — for example, `GET /api/v1/relationships` resolves to `https://app.visotrust.com/api/v1/relationships`.

## Generate an API Token

API tokens are tied to a user account. The public API requires program-level access, so generate the token from an **Admin** or **Program Manager** account.

<Steps>
  <Step title="Open your user profile">
    Log in to the [Dashboard](https://app.visotrust.com) as the user the token should act as, then open your user profile.
  </Step>

  <Step title="Generate the token">
    Generate an API token from the profile. The token is shown only once at generation.
  </Step>

  <Step title="Store it securely">
    Copy the token and store it in a secrets manager or equivalent. You cannot retrieve it again later — if it is lost, generate a new one.
  </Step>
</Steps>

<Tip>
  For automation and integrations, generate the token from a dedicated service account rather than a personal account. This keeps API access from being tied to an individual's employment status and makes token lifecycle easier to manage.
</Tip>

## Authenticate a Request

Send the token as a bearer token in the `Authorization` header:

```bash theme={null}
curl https://app.visotrust.com/api/v1/relationships \
  -H "Authorization: Bearer YOUR_API_TOKEN"
```

The same token authenticates the [MCP server](https://mcp.visotrust.com/sse) for AI tool integrations — pass it as a bearer token there as well.

<Note>
  The interactive playground on each endpoint page sends real requests to `https://app.visotrust.com` using the token you enter. Use a token scoped to an account with the access you intend to exercise.
</Note>

## Permissions

The public API requires program-level access. Tokens generated from an **Admin** or **Program Manager** account can call the `/api/v1/*` endpoints; tokens from Contributor or Viewer accounts cannot. If a request returns a permission error, confirm the token's account has Admin or Program Manager access. See [Roles and permissions](/getting-started/roles-and-permissions) for details.