---
title: "Authentication"
slug: "authentication-api"
updated: 2026-02-16T08:38:45Z
published: 2026-02-16T08:41:18Z
canonical: "developer.rocket.chat/authentication-api"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://developer.rocket.chat/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

Rocket.Chat supports multiple authentication methods to secure API communication, including standard username-and-password login and OAuth integrations with providers such as Google, Facebook, and Twitter.

To access protected Rocket.Chat API endpoints, you must include both a valid authentication token and your user ID in the request headers:

- `x-Auth-Token` : The authentication token that verifies your session.
- `x-User-Id` : The unique identifier of the authenticated user.

## Authentication tokens

Authentication tokens uniquely identify an active user session within a Rocket.Chat workspace. They confirm the user’s identity and permissions, enabling secure access to API features and resources.

For any endpoint that requires authentication, include your token in the **X-Auth-Token** header.

Rocket.Chat supports two primary types of authentication tokens:

1. `authToken` : It is a temporary token issued after a successful login through any login endpoint. Workspace administrators can also generate an authToken on behalf of a user using the [**Create User Token**](https://developer.rocket.chat/apidocs/create-users-token) endpoint.
2. Personal Access Token: It is a long-lived token that users can generate to securely access the API without exposing their primary credentials.
  - To create a token through the user interface, see the [**Manage Personal Access Tokens**](https://docs.rocket.chat/docs/manage-personal-access-tokens) guide.
  - To generate one via the API, use the [**Get Personal Access Tokens**](https://developer.rocket.chat/apidocs/generate-personal-access-token) endpoint.