# Authentication

> Part of the NocoDB documentation (APIs). Index of all pages: https://nocodb.com/llms.txt. Any docs page is available as Markdown by adding `.md` to its URL.

URL: https://nocodb.com/docs/apis/authentication
Last updated: 2026-10-21

Authenticate NocoDB REST API requests with an API token, sent in the xc-token header or as a Bearer token, and explore endpoints in the Swagger UI.

Every NocoDB API request needs an API token. Send the token in the `xc-token` header or in the `Authorization` header as a Bearer token.

## API Tokens

Use API tokens to authorize NocoDB API requests. With API tokens, you can integrate NocoDB with third-party apps. For more information, refer to [API Tokens Management](/docs/product/account-settings/api-tokens).

## Send the token

<Tabs items={['xc-token header', 'Authorization header']}>
  <Tab value="xc-token header">
    ```bash
    curl -H "xc-token: nc_pat_..." https://your-nocodb.com/api/v3/...
    ```
  </Tab>

  <Tab value="Authorization header">
    ```bash
    curl -H "Authorization: Bearer nc_pat_..." https://your-nocodb.com/api/v3/...
    ```
  </Tab>
</Tabs>

The two methods are equivalent. Use the method that fits the authentication pattern of your application. When a request sends both headers, NocoDB uses `xc-token`.

A request succeeds only when the token and the role of the user who owns the token both allow it.

## Swagger UI

You can work with the API resources in the Swagger UI. For more information, refer to [Swagger APIs Doc](/docs/product/projects/actions-on-project#rest-apis).

## Good to know

* Store tokens securely. For the full list of token practices, see [Security Best Practices](/docs/product/account-settings/api-tokens#security-best-practices).
* A token that you created before a workspace enforced SSO does not work for that workspace. See [API Token Access with SSO-Enabled Workspaces](/docs/product/account-settings/api-tokens#api-token-access-with-sso-enabled-workspaces).

## Related

* [NocoDB API Quickstart](/docs/apis)
* [Errors and Rate Limits](/docs/apis/errors)

---

## Related pages

- [NocoDB API Quickstart](https://nocodb.com/docs/apis.md): Make your first NocoDB REST API request: create an API token, find your project and table IDs, then list the records of a table with the v3 Data API.
- [Find IDs](https://nocodb.com/docs/apis/ids.md): Find the workspace, base, table, view, field, record, user and data source IDs that NocoDB REST API endpoints need, and the prefix of each ID.
- [Filtering](https://nocodb.com/docs/apis/filtering.md): Filter NocoDB REST API results with the where query parameter: comparison operators, date sub-operators, logical operators and the quoted v3 syntax.
- [Query Parameters](https://nocodb.com/docs/apis/query-parameters.md): Query parameters of NocoDB REST API list requests: where, limit, offset, sort, fields and shuffle, with their aliases, defaults and example values.
- [Pagination](https://nocodb.com/docs/apis/pagination.md): Page through NocoDB REST API results: follow the next and prev URLs of v3 record lists, and use limit, offset and pageInfo for the base list.
- [Errors and Rate Limits](https://nocodb.com/docs/apis/errors.md): NocoDB REST API errors and rate limits: the JSON error body, what each HTTP status code means, request IDs, and how to handle a 429 response.
- [Upload Files](https://nocodb.com/docs/apis/upload-files.md): Upload local files to a NocoDB Attachment field with the REST API: code samples in JavaScript, Bash, TypeScript, Python, Ruby and Java, for one file or a batch.
- [Delete Records by ID](https://nocodb.com/docs/apis/delete-records.md): Delete NocoDB records, or unlink linked records, by sending the record ids in a records query parameter when a client or proxy removes the DELETE body.