> ## Documentation Index
> Fetch the complete documentation index at: https://api-docs.rookoo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate Application, Platform, and Client API requests.

Send the access token in the `api_access_token` header. The same header name is used for user tokens, agent bot tokens, and platform app tokens. The token type decides which routes you can call.

```bash theme={null}
curl https://app.rookoo.ai/api/v1/profile \
  -H "api_access_token: YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json"
```

A missing or unknown token returns `401`.

## User access token

A user access token calls the Application API with that user's permissions.

Each user has one access token. It is returned on the user profile:

```bash theme={null}
curl https://app.rookoo.ai/api/v1/profile \
  -H "api_access_token: YOUR_ACCESS_TOKEN"
```

The response includes `access_token`. You can also copy the token from the profile page in the portal. `POST /api/v1/profile/reset_access_token` rotates it and invalidates the previous value.

Account routes also need the account id:

```bash theme={null}
curl https://app.rookoo.ai/api/v1/accounts/1/conversations \
  -H "api_access_token: YOUR_ACCESS_TOKEN"
```

## Agent bot token

An agent bot has its own access token. Use it for bot integrations. The token can call a limited set of Application API routes, including conversation status, messages, assignments, contact search, and knowledge base search. Other Application API routes return `401`.

## Platform app token

A platform app token calls the Platform API: accounts, account users, users, and agent bots. Create the platform app in super admin, then send its access token:

```bash theme={null}
curl https://app.rookoo.ai/platform/api/v1/accounts \
  -H "api_access_token: YOUR_PLATFORM_APP_TOKEN" \
  -H "Content-Type: application/json"
```

A user access token cannot call these routes.

## OAuth 2.0

For third-party apps and MCP clients, prefer OAuth 2.0. Account admins register clients under **Settings → Integrations → OAuth Applications**. See [OAuth clients](/oauth-clients) for authorization code, client credentials, scopes, and discovery endpoints.

Send the issued JWT as a bearer token:

```bash theme={null}
curl https://app.rookoo.ai/api/v1/accounts/1/conversations \
  -H "Authorization: Bearer YOUR_OAUTH_JWT"
```

Supported scopes: `profile` (default), `accounts`, `read`, `write`. Access tokens expire after 2 hours; use refresh tokens to renew them.

## Client API

The Client API does not use `api_access_token`. Identify the inbox in the path with the inbox identifier from the API channel settings.

```bash theme={null}
curl https://app.rookoo.ai/public/api/v1/inboxes/INBOX_IDENTIFIER
```

Contact and conversation routes add the contact source id and the conversation display id to that path.