---
title: "Authentication Overview | Tajo"
description: "Overview of authentication methods"
url: https://tajo.io/docs/authentication/
markdown: https://tajo.io/docs/authentication.md
lang: en-US
author: "Set Noa"
author_url: https://tajo.io/set-noa/
---

# Authentication Overview

[Set Noa](https://tajo.io/set-noa/)

Caution

**Demo Page** - This is a demo page to showcase the multi-tab documentation feature. This content is for illustration purposes only.

This guide explains how to authenticate with our API. We support several authentication methods:

## API Keys

The simplest authentication method is to use API keys. Each API key is associated with a specific user and has specific permissions.

```javascript
// Example API Key request
const response = await fetch('https://api.example.com/data', {
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY'
  }
});
```

## OAuth 2.0

For more secure applications, we support OAuth 2.0 authentication flow:

1. **Authorization Request**: Redirect users to our authorization URL
2. **User Consent**: User approves access to their account
3. **Authorization Code**: Our server returns an authorization code
4. **Token Exchange**: Exchange the code for an access token
5. **API Requests**: Use the access token to access protected resources

## JWT Tokens

After authentication, we issue JWT tokens that contain encoded information about the user and their permissions.

```javascript
// Example JWT token usage
const response = await fetch('https://api.example.com/protected-resource', {
  headers: {
    'Authorization': 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
  }
});
```

## Session Management

Sessions are valid for 24 hours by default. To refresh a session:

```javascript
const refreshResponse = await fetch('https://api.example.com/auth/refresh', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer CURRENT_REFRESH_TOKEN'
  }
});

// Parse the new tokens
const { accessToken, refreshToken } = await refreshResponse.json();
```

## Best Practices

1. Never store API keys or tokens in client-side code
2. Use environment variables for sensitive credentials
3. Implement token refresh mechanisms for long-running applications
4. Set appropriate token expiration times
5. Use HTTPS for all API requests