---
title: Authentication
description: Learn how to authenticate with the SIBI API
---

SIBI issues two kinds of tokens, one per API:

- **REST API tokens** authenticate the REST APIs at `https://api.sibipro.com`. They are scoped, and the GraphQL API
  rejects them. See [REST API Tokens](/getting-started/rest-tokens).
- **GraphQL tokens** — the tokens described on this page — authenticate the GraphQL API. REST endpoints refuse them; see
  [GraphQL tokens on REST](/getting-started/rest-tokens#graphql-tokens-on-rest).

## Obtaining an Access Token

You can retrieve your token from **[SIBI Developer Portal](https://developer.sibipro.com/)** using your login credentials.

### Example Authorization Header

Once you have your token, include it in the `Authorization` header for all API requests:

```http
Authorization: Bearer YOUR_ACCESS_TOKEN
```

> **Important: Token Storage**
>
> - This token **does not expire** and **cannot be retrieved again** after it is issued.
> - Store it in a **secure location** you will remember.

## Revoking a Token

Either kind of token can revoke itself by sending a `DELETE` request to `/token` with the token in the `Authorization: Bearer` header.

```bash
curl -X DELETE https://api.sibipro.com/token \
  -H "Authorization: Bearer YOUR_API_TOKEN"
```

A successful revocation returns a `204 No Content` response. After revocation, the token can no longer be used to authenticate requests.