> ## Documentation Index
> Fetch the complete documentation index at: https://veridical-dev.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# API authentication

> WorkOS users and scoped service identities

Send the access token as:

```http theme={null}
Authorization: Bearer <token>
```

The server verifies signature, issuer, audience, time claims, subject, and
organization identity before mapping workspace membership and role. Expired,
wrong-audience, or wrong-organization tokens fail closed.

Interactive CLI and IDE clients use WorkOS device authorization and refresh
their session through secure operating-system credential storage. Automation
should use a contracted service identity with least privilege and a short-lived
token; never embed an interactive refresh token in CI.