# Authentication

## Two credentials, two jobs

### Account session

The web console uses a short-lived access JWT and rotating refresh token. Send
the access token as a bearer token only to console endpoints:
`/v2/projects`, `/v2/api-keys`, `/v2/provider-catalog`, and everything under
`/console/v2/`.

`401` may mean the access token expired. The first refresh rotates both tokens;
concurrent console requests share that refresh and retry once. A `403` is an
authorization decision and must not trigger token refresh.

### Project API key

Machine endpoints use:

`X-Api-Key: dvk_...`

The key identifies its project on the server. Do not send a different project ID
in a body and expect it to widen access. Keep the plaintext in a server-side
secret manager. Never embed it in JavaScript shipped to a browser, a mobile
bundle, a public repository, logs, or analytics.

Keys are stored as hashes. Creation is the only response that contains the
plaintext; revoke and replace a lost key. A project key presented to a
`/console/v2/` route authenticates nothing.

---

Source: https://developers.dvaarik.com/docs/authentication · every page as one file: https://developers.dvaarik.com/docs.md