# Authentication

Every request carries a bearer token. The token identifies both you and your
channel, so you never send a seller or channel id with a product.

```http
POST /api/bobsync/products HTTP/1.1
Host: api.tools.bobshop.co.za
Authorization: Bearer YOUR_UNIQUE_TOKEN
Content-Type: application/json
```

## Your token

- It is generated when an administrator installs an API source on Bob Sync for
  your account. You cannot create one yourself. Contact
  [support](https://help.bobshop.co.za/).
- **It is shown once**, when the channel is created, and cannot be viewed again
  or rotated. Store it as soon as you receive it. If it is lost, the channel
  has to be recreated, with a new token and a re-send of your catalogue.
- **It does not expire.** It stays valid until the channel is removed.
- **It is tied to one environment.** Sandbox is our QA environment, and a
  Sandbox token does not work on Production, or the other way round. You are
  issued one for each. Keep them apart so a test run cannot write to your live
  listings.

## Keeping it safe

- Treat it as a password. Never put it in client-side code, a public
  repository or a support ticket.
- Call the API over HTTPS only.
- Store it as a secret: an environment variable or a secret manager, not
  source control.
- If it is exposed, contact support at once. A leaked token means the channel
  has to be recreated.

## Failures

| Status | Body | Meaning |
| --- | --- | --- |
| `401` | `Cookie, platform or header auth is required` | No `Authorization` header. |
| `401` | `Invalid authentication token: ...` | The header has no `Bearer ` prefix. |
| `401` | `api key is not valid` | The token is not recognised, or its channel has been removed. |
| `401` | `invalid endpoint` | The token was sent to a path outside `/api/bobsync/`. |