> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leamout.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API authentication

> Use scoped organization bearer credentials with Leamout APIs.

Authenticate server-to-server API requests with:

```http theme={null}
Authorization: Bearer lm_org_...
```

Bearer credentials resolve directly to one organization. Resource authorization then checks scopes using `<resource>:read` for `GET`/`HEAD` and `<resource>:write` for mutations.

Invalid or missing credentials return `401 UNAUTHORIZED`. A valid credential without the required resource scope returns `403 FORBIDDEN`.

Session-cookie authentication exists for interactive identity and organization-management routes, but application integrations should use organization credentials.