> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enfors.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate to the Enfors Data API.

The Enfors Data API serves read access to your workspace. It accepts two kinds of
credentials, both presented as a bearer token.

## Base URL

```
https://data.enfors.ai
```

REST endpoints are versioned under **`/v1`**. The MCP server is mounted at **`/mcp`**
(see [MCP overview](/mcp/overview)).

<Note>
  These credentials authenticate the **Data API** on `data.enfors.ai` — the read side.
  Interactive clients sign in via **SSO**: this is how both the [watcher](/getting-started/quickstart)
  and the [Ask Enfors MCP server](/mcp/overview) (`data.enfors.ai/mcp`) connect. Scripts and
  services use a **Personal Access Token** instead. All of this is separate from the **LLM
  Gateway Key**, which authenticates model calls routed through the gateway (`llm.enfors.ai`)
  and is provisioned automatically at signup.
</Note>

## Token types

<CardGroup cols={2}>
  <Card title="Personal Access Token (enf_live_…)" icon="key">
    Opaque, long-lived tokens for programmatic access to the Data API. Validated inline by
    Enfors. Create one under **Admin → API Keys → Personal Access Tokens**; the plaintext is
    shown once. Best for scripts, services, and non-OAuth clients.
  </Card>

  <Card title="SSO (OAuth / JWT)" icon="id-badge">
    The default for interactive use — the watcher and OAuth-capable MCP clients run the SSO
    flow, and the web app uses short-lived JWTs verified via the API Gateway authorizer.
  </Card>
</CardGroup>

## Making a request

```bash theme={null}
curl https://data.enfors.ai/v1/agents \
  -H "Authorization: Bearer enf_live_xxxxxxxx"
```

<Note>
  Every request is scoped to your tenant, workspace, and user by Row-Level Security. You
  can only read data you're entitled to — there is no cross-tenant access. See
  [Tenancy, Privacy & PII](/concepts/tenancy-privacy-pii).
</Note>

## Which surface should I use?

* **Asking questions / building agents** → use the [MCP server](/mcp/overview). It
  exposes safe, high-level tools and is what Claude Code / Cursor / Claude Desktop talk to.
* **Direct integration / data export** → use the [REST endpoints](/api-reference/audit).