---
title: "Authentication - REST"
canonical: "https://docs.getxray.app/space/XRAYCLOUD/44566627/Authentication%20-%20REST"
format: markdown
---
# Authenticate

<span style="color: #000000">Xray provides a REST API with endpoints specifically made for dealing with test management.</span>  
Requests made to Xray's REST API must be authenticated based on an API Key created for some user in the Xray [Global Settings - API Keys](https://getxraydocs.atlassian.net/wiki/spaces/XRAYCLOUD/pages/44568019).  
Thus, the first step you need to do is to obtain a token based on the Client ID and Client Secret of your assigned API Key. You can then use that token to make requests to the Xray Cloud.

> ℹ️ API keys (Client ID and Client secret) do not expire. However, the bearer token generated using the API keys expires after **24 hours.**


> Macro (rw-ui-expands-macro)
> 
> > Macro (rw-expand)
> 
> |  |
> | --- |
> | Authenticates the requester based on the provided Client Id and Client Secret and returns an authorization token to be used in other API requests.<br><span style="color: #003366">**Request**</span>** **<br>**<span style="color: #003366">Example</span>**<br>##### **Authentication JSON**<br>```
> { "client_id": "32A27E69C0AC4E539C1401643709E8E7","client_secret": "d62f81eb9ed859e22e54356dd8a00e4a5f0d0c2b2b52340776f6c7d6d757b962" }
> ```<br>> ✅ **Example Requests**
> > ✅ 
> > ✅ curl -H "Content-Type: application/json" -X POST --data @"cloud_auth.json" [https://xray.cloud.getxray.app/api/v1/authenticate](https://xray.cloud.getxray.app/api/v1/authenticate)
> > ✅ 
> > ✅ curl -H "Content-Type: application/json" -X POST --data '{ "client_id": "32A27E69B0AC4E539C1401643799E8E7","client_secret": "d62f81eb9ed859e11e54356dd8a00e4a5f0d0c2a2b52340776f6c7d6d757b962" }'  [https://xray.cloud.getxray.app/api/v1/authenticate](https://xray.cloud.getxray.app/api/v1/authenticate)
> > ✅ 
> > ✅ # the following example, shows a way of setting a shell variable with the token value, so it can be used in subsequent requests
> > ✅ 
> > ✅ token=$(curl -H "Content-Type: application/json" -X POST --data @"cloud_auth.json" [https://xray.cloud.getxray.app/api/v1/authenticate|](#) tr -d '"')<br><span style="color: #003366">**Responses**</span>** **<br>200 OK : **application/json** : Successful. Returns a JSON string (delimited with the " character), containing the authorization token.<br>##### **Example Output**<br>```
> "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnQiOiI0MjZiYzA4Yy02N2VmLTNjMjYtYWU1YS03NjczYTB1ZjIwNjkiLCJ1c2VyS2V5IjoiYW5kcmUucm9kcmlndWVzIiwiaWF0IjixNTI1ODcxODkzLCJleHAiOjE1MjU5NTgyOTMsImF1ZCI6IhMyQTI3RTY5QjBBQzRFNTM5QzE0MDE2NDM3OTlFOEU3IiwiaXNzIjoiY29tLnhwYW5kaXQueHJheSIsInN1YiI6IjMyQTI3RTY5QjBBQzRFNTM5QzE0MDE2NDM3OTlFOEU3In0.8ah2IQ9rA_zotyh_6trFgfIvhn2awdFFrOHnN2F2H7m"
> ```<br>400 BAD_REQUEST : **text/plain**** ****: **Wrong request syntax.<br>401 UNAUTHORIZED : **text/plain** : The Xray license is not valid.<br>500  INTERNAL SERVER ERROR : **text/plain** : An internal error occurred when authenticating the request. |