> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/grafana/grafana/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authentication methods for the Grafana API

# Authentication API

The Grafana API supports multiple authentication methods for secure access to API endpoints.

## Authentication Methods

Grafana supports the following authentication methods:

1. **Basic Authentication** - Username and password
2. **API Keys** - Token-based authentication
3. **Session Cookies** - Browser-based authentication

## Basic Authentication

Use HTTP Basic Authentication with your Grafana username and password:

```bash theme={null}
curl -u admin:admin http://localhost:3000/api/org
```

### Security Definitions

<ParamField path="basic" type="basic">
  HTTP Basic Authentication using username and password
</ParamField>

## API Key Authentication

API keys provide a secure way to authenticate API requests without exposing user credentials.

### Security Definitions

<ParamField path="api_key" type="apiKey">
  API Key authentication

  **Location**: Header\
  **Name**: `Authorization`\
  **Format**: `Bearer <api-key>`
</ParamField>

### Using API Keys

Include the API key in the `Authorization` header:

```bash theme={null}
curl -H "Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk" \
  http://localhost:3000/api/org
```

## Session Authentication

### Login

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST http://localhost:3000/api/login \
    -H "Content-Type: application/json" \
    -d '{
      "user": "admin",
      "password": "admin"
    }'
  ```

  ```json Response theme={null}
  {
    "message": "Logged in"
  }
  ```
</CodeGroup>

<ParamField body="user" type="string" required>
  Username or email address
</ParamField>

<ParamField body="password" type="string" required>
  User password
</ParamField>

<ResponseField name="message" type="string">
  Login success message
</ResponseField>

### Logout

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET http://localhost:3000/api/logout
  ```
</CodeGroup>

Logs out the current user and clears the session cookie.

## User Auth Tokens

### Get Auth Tokens

Get all auth tokens for the current user.

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET http://localhost:3000/api/user/auth-tokens \
    -u admin:admin
  ```

  ```json Response theme={null}
  [
    {
      "id": 1,
      "isActive": true,
      "clientIp": "127.0.0.1",
      "browser": "Chrome",
      "browserVersion": "91.0",
      "os": "Linux",
      "osVersion": "",
      "device": "Other",
      "createdAt": "2021-06-01T10:00:00Z",
      "seenAt": "2021-06-01T12:00:00Z"
    }
  ]
  ```
</CodeGroup>

<ResponseField name="id" type="integer">
  Token ID
</ResponseField>

<ResponseField name="isActive" type="boolean">
  Whether the token is currently active
</ResponseField>

<ResponseField name="clientIp" type="string">
  IP address of the client
</ResponseField>

<ResponseField name="createdAt" type="string">
  Token creation timestamp (ISO 8601)
</ResponseField>

### Revoke Auth Token

Revoke a specific auth token.

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST http://localhost:3000/api/user/revoke-auth-token \
    -u admin:admin \
    -H "Content-Type: application/json" \
    -d '{
      "authTokenId": 1
    }'
  ```

  ```json Response theme={null}
  {
    "message": "User auth token revoked"
  }
  ```
</CodeGroup>

<ParamField body="authTokenId" type="integer" required>
  ID of the auth token to revoke
</ParamField>

### Rotate Auth Token

Rotate the current auth token.

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST http://localhost:3000/api/user/auth-tokens/rotate \
    -u admin:admin
  ```

  ```json Response theme={null}
  {
    "message": "Token rotated",
    "token": "new-token-value"
  }
  ```
</CodeGroup>

## Authentication Errors

### 401 Unauthorized

Returned when authentication credentials are missing or invalid.

```json theme={null}
{
  "message": "Unauthorized"
}
```

### 403 Forbidden

Returned when the authenticated user lacks permission for the requested resource.

```json theme={null}
{
  "message": "Permission denied"
}
```