> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plazza.ca/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Send the session token of a signed-in Plazza account.

Reading the public roadmap needs no token: listing and getting a board's items, their activity and
comments, and its facets under `/v1/roadmapBoards/{board}`. Every other endpoint asks for a session
token. Send it in the `Authorization` header:

```http theme={null}
Authorization: Bearer <session token>
```

A session token comes from a signed-in session in a Plazza app. It lasts about a minute, and the app
renews it while the session is open. Keep it in memory, never in logs or URLs.

> [!NOTE]
>
> A session token is the only credential the API accepts today. There are no API keys yet, so only
> Plazza's own apps can call the API.

## When a token is refused

A request without a usable token answers `401` with the status `UNAUTHENTICATED`. The error's
`reason` says why:

| Reason | The token |
| - | - |
| `MISSING_CREDENTIALS` | Is missing. |
| `NOT_A_SESSION` | Isn't a session's, such as a machine token. |
| `UNTRUSTED_PARTY` | Was issued to a website other than Plazza's. |
| `PENDING_SESSION` | Belongs to a sign-in that still has a step to finish. |
| `UNAUTHENTICATED` | Is expired, malformed or badly signed, or names no account. |

A token whose account is closed answers `403` with the status `PERMISSION_DENIED` and the reason
`ACCOUNT_DEACTIVATED`. See [Errors](https://docs.plazza.ca/guides/errors.md) for the full shape.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.