> ## Documentation Index
> Fetch the complete documentation index at: https://docs.publishbuddy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Quick reference for sending a personal access token on every request.

Every request to the PublishBuddy API must include a Bearer token.

```http theme={null}
Authorization: Bearer <your-token>
```

Tokens are issued from the dashboard under **User Settings → Login & Security** at [app.publishbuddy.com](https://app.publishbuddy.com). For the full walkthrough — generating, scoping, rotating, and revoking tokens — see the [Authentication guide](/authentication).

## Required token abilities by endpoint group

| Endpoint group                                                                                                                                     | Required ability                   |
| -------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- |
| `/workspaces`                                                                                                                                      | `workspaces`                       |
| `/workspaces/{workspace}/profiles`                                                                                                                 | `profiles`                         |
| `/workspaces/{workspace}/posts`, `/posts/{post}`                                                                                                   | `posts`                            |
| `/workspaces/{workspace}/media_contents`, `/media_contents/{...}`, `/workspaces/{workspace}/media_library/folders`, `/media_library/folders/{...}` | `media_contents`                   |
| `/analytics/*`, `/profiles/{profile}/metrics`, `/profiles/{profile}/hashtags`, `/workspaces/{workspace}/hashtags`                                  | `analytics` (and `posts` for some) |

The API rejects requests whose token lacks the required ability with `403`. To add an ability to an existing token, create a new token with the desired ability set — abilities cannot be added retroactively to an existing token.

## Failure modes

| Status | Body                                            | Cause                                                                        |
| ------ | ----------------------------------------------- | ---------------------------------------------------------------------------- |
| `401`  | `{ "message": "Unauthenticated." }`             | Missing, malformed, or revoked `Authorization` header.                       |
| `403`  | `{ "message": "Invalid ability provided." }`    | Token is valid but doesn't include the required ability.                     |
| `403`  | `{ "message": "This action is unauthorized." }` | The user behind the token has no access to the target workspace or resource. |

See [Errors](/api-essentials/errors) for the full error reference.