> ## Documentation Index
> Fetch the complete documentation index at: https://developer.hellgate.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate to your Guardian instance with an OAuth2 access token and the scopes that gate each endpoint.

Once your Guardian instance is provisioned (see [Plans & Access](/products/guardian/plans-and-access)), you
reach the API at your dedicated instance URL, where `{instance}` is your unique instance slug and `eu1` is the
current environment; both are provided during onboarding:

```
https://{instance}.eu1.on-hellgate.cloud
```

## Authentication

Every API request must carry an OAuth2 access token — a signed JSON Web Token (JWT) — in the
`Authorization` header:

```http theme={null}
Authorization: Bearer <access_token>
```

You request the token with the client-credentials grant — see [Authentication](/platform/authentication) for
the token endpoint, audiences, and scopes. Your instance's audience is its instance name.

<Note>
  **API keys are deprecated.** Guardian still accepts a long-lived instance key in the `x-api-key` header, so
  existing integrations keep working, but new integrations should use an access token. The `x-admin-token`
  header has been replaced — administrative endpoints now use the same access token carrying the relevant
  `admin:*` scope.
</Note>

## Scopes

Each endpoint requires a specific scope. Request only the scopes a given integration needs through the
`scope` parameter when you [request a token](/platform/authentication) — follow the principle of least
privilege.

### Token operations

| Scope                       | Grants                                                                                                     |
| --------------------------- | ---------------------------------------------------------------------------------------------------------- |
| `pci:tokens:create`         | `POST /api/pci/tokens`                                                                                     |
| `pci:tokens:read`           | `GET /api/pci/tokens`<br />`GET /api/pci/tokens/{id}`<br />`GET /api/pci/tokens/{id}/security-code`        |
| `pci:tokens:update`         | `POST /api/pci/tokens/{id}/security-code`<br />`DELETE /api/pci/tokens/{id}/security-code`                 |
| `pci:tokens:delete`         | `DELETE /api/pci/tokens/{id}`                                                                              |
| `pci:tokens:forward`        | `POST /api/pci/tokens/{id}/forward`                                                                        |
| `generic:tokens:create`     | `POST /api/generic/tokens`                                                                                 |
| `generic:tokens:read`       | `GET /api/generic/tokens`<br />`GET /api/generic/tokens/{id}`<br />`GET /api/generic/tokens/{id}/payload`  |
| `generic:tokens:delete`     | `DELETE /api/generic/tokens/{id}`                                                                          |
| `network:tokens:create`     | `POST /api/network/tokens`                                                                                 |
| `network:tokens:read`       | `GET /api/network/tokens`<br />`GET /api/network/tokens/{id}`<br />`GET /api/network/tokens/{id}/card-art` |
| `network:tokens:delete`     | `DELETE /api/network/tokens/{id}`                                                                          |
| `network:tokens:use`        | `POST /api/network/tokens/{id}/cryptograms`                                                                |
| `network:tokens:forward`    | `POST /api/network/tokens/{id}/forward`                                                                    |
| `metadata:inquiries:create` | `POST /api/metadata/inquiries`                                                                             |

<Note>
  `network:tokens:*` requires the **Network Tokens** add-on, and `metadata:inquiries:create` requires the
  **Metadata Inquiries** add-on, enabled on your instance. See [Plans & Access](/products/guardian/plans-and-access).
</Note>

### Administrative operations

Administrative endpoints manage the instance itself. They require a token carrying the relevant `admin:*`
scope, and should be issued to operator or back-office clients only.

| Scope                   | Grants                                                        |
| ----------------------- | ------------------------------------------------------------- |
| `admin:api-keys:create` | `POST /api/admin/api-keys`                                    |
| `admin:api-keys:read`   | `GET /api/admin/api-keys`<br />`GET /api/admin/api-keys/{id}` |
| `admin:api-keys:update` | `PATCH /api/admin/api-keys/{id}`                              |
| `admin:api-keys:delete` | `DELETE /api/admin/api-keys/{id}`                             |
| `admin:webhooks:create` | `POST /api/admin/webhooks`                                    |
| `admin:webhooks:read`   | `GET /api/admin/webhooks`<br />`GET /api/admin/webhooks/{id}` |
| `admin:webhooks:delete` | `DELETE /api/admin/webhooks/{id}`                             |
| `admin:types:create`    | `POST /api/admin/types`                                       |
| `admin:types:read`      | `GET /api/admin/types`<br />`GET /api/admin/types/{id}`       |
| `admin:types:delete`    | `DELETE /api/admin/types/{id}`                                |
| `admin:imports:create`  | `POST /api/admin/imports`                                     |
| `admin:imports:read`    | `GET /api/admin/imports/{id}`                                 |
| `admin:imports:cancel`  | `POST /api/admin/imports/{id}/cancel`                         |

## Next steps

<Card title="API Keys" icon="key" href="/products/guardian/management/api-keys">
  Manage the deprecated instance API keys that existing integrations still use.
</Card>