> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate to the Reyhford API with API keys or WorkOS JWT.

Reyhford uses **Bearer token** authentication at the API gateway (`api.reyhford.com`).

## TAXII 2.1 (machine clients)

TAXII collection and object endpoints require an API key:

```bash theme={null}
Authorization: Bearer <your-api-key>
```

API keys are issued from [app.reyhford.com](https://app.reyhford.com). Keys are stored as SHA-256 hashes server-side; the plaintext is shown once at creation.

<Warning>
  Treat API keys like passwords. Rotate keys if compromised and never commit them to source control.
</Warning>

### Scopes

| Endpoint                                | Auth required |
| --------------------------------------- | ------------- |
| `GET /taxii2/` (discovery)              | No            |
| `GET /taxii2/collections/`              | API key       |
| `GET /taxii2/collections/{id}/objects/` | API key       |

## Indicators REST API (application clients)

The `/v1/indicators/*` endpoints accept:

1. **WorkOS JWT** — for dashboard and SaaS integrations (`indicators:read` scope)
2. **API key** — for machine-to-machine access

```bash theme={null}
curl -s https://api.reyhford.com/v1/indicators/{id} \
  -H "Authorization: Bearer <token>"
```

## Rate limiting

Zuplo enforces rate limits at the gateway. TAXII polling should use incremental `added_after` cursors rather than full feed pulls.

## Errors

| Status | Meaning                                  |
| ------ | ---------------------------------------- |
| `401`  | Missing or invalid token                 |
| `403`  | Valid token but insufficient scope       |
| `429`  | Rate limit exceeded — back off and retry |

See the [Quickstart](/quickstart) for a working curl example.