---
title: "Authentication"
slug: "authentication"
updated: 2026-01-12T11:10:28Z
published: 2026-01-12T11:10:28Z
canonical: "developers.torq.io/authentication"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://developers.torq.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

Torq REST API uses bearer tokens to authenticate requests. Generate a bearer token by sending a request to the Torq authentication server. In the request to the authentication server, provide your Torq API key, which consists of a client ID and client secret. After a successful request to the authentication server, you'll receive a bearer token that you can pass in the Authorization header for all Torq API requests.

🗒️ NOTEA bearer token is valid for one hour (3,600 seconds).

## Create an API key

The API key consists of a client_id and client_secret. These credentials are used to authenticate when you request a bearer token.

API keys are workspace-specific. This means that requests are made on the workspace where the API key used to create the bearer token was created. Make sure the API key you're using to generate the bearer token was created in the workspace you want to run the requests on.

NOTEFind more information on creating personal and service API keys [here](https://kb.torq.io/en/articles/9145827-create-a-torq-api-key-enable-programmatic-access).

1. In Torq, click your user icon/avatar.
2. Click **API Keys** > **Create API Key**.
3. Give the API key a meaningful name and click Create.
4. Copy the Client ID and Client Secret to a safe place. You won't be able to access the Client Secret later.

## Generate a bearer token

To generate a bearer token, send a request to the appropriate authentication endpoint: `https://auth.torq.io/v1/auth/token` or, for users on the `eu.torq.io` domain, `https://auth.eu.torq.io/v1/auth/token`. See the example request below.

IMPORTANTIf you're using the eu.torq.io domain, make sure to update the API base URL accordingly. [Learn more.](https://torq.document360.io/apidocs/overview#domains)

### Sample request - cURL

Replace <CLIENT_ID> and <CLIENT_SECRET> with the client ID and client secret you received when you created the API key.

```shell
curl POST https://auth.torq.io/v1/auth/token -H "Accept: application/json"  -H "Accept-Language: en_US"  -u "<CLIENT_ID>:<CLIENT_SECRET>"  -d "grant_type=client_credentials"
```

### Sample response - cURL

The bearer token is the value of the access_token key.

You will pass this token in the authorization header for all API requests: Authorization: Bearer <token>.

```json
{"access_token":"81b15ad9-****-2245-****-f05p37053b25","expires_in":3600,"token_type":"Bearer"}
```

### Sample request - Torq

You can generate the bearer token in Torq by using the **Send an HTTP Request** step. You need to add a body field for the grant type.

| Field | Value |
| --- | --- |
| URL | https://auth.torq.io/v1/auth/token |
| Method | POST |
| Authorization | Basic |
| Username | The client_id you received when you created the API key. |
| Password | The client_secret you received when you created the API key. |
| Content type | application/x-www-form-urlencoded |
| Type | - Name: grant_type - Value: client_credentials |

### Sample response - Torq

```json
{
  "api_object": {
    "access_token": "8266095f-****-****-****-203a47f40c06",
    "expires_in": 3600,
    "token_type": "Bearer"
  },
  "headers": {
    "Access-Control-Allow-Credentials": "true",
    "Access-Control-Allow-Origin": "https://app.torq.io",
    "Cache-Control": "no-store",
    "Content-Length": "96",
    "Content-Type": "application/json;charset=UTF-8",
    "Date": "Mon, 21 Mar 2022 15:00:02 GMT",
    "Pragma": "no-cache",
    "Strict-Transport-Security": "max-age=15724800; includeSubDomains"
  },
  "status_code": 200,
  "step_status": {
    "code": 1,
    "message": "",
    "verbose": ""
  }
}
```