# Authenticate API requests | Orion Data API v1.3

> For the complete documentation index, see [llms.txt](https://docs.oriondata.io/llms.txt)

How to generate an API key in Orion Data, exchange it for a JWT bearer token, and authenticate requests to the Orion Data API.

The Orion Data API uses API keys to identify the calling user and JWT bearer tokens to authenticate individual requests. Generate an API key once from the Orion Data application, then exchange it for a short-lived bearer token whenever you start a new session.

## Generate an API key

API keys are managed from the Orion Data application:

1. **Open Account Settings**

   Sign in to [Orion Data](https://oriondata.io) and navigate to **Account Settings**.

2. **Generate an API key**

   Use the API key controls in **Account Settings** to generate a new key.

3. **Store the key securely**

   Treat the API key like a password. Anyone with the key can request a bearer token on behalf of your user.

## Exchange the key for a bearer token

Call the [Generate a bearer token](https://docs.oriondata.io/api/orion-data/v1-3/operations/gettoken/) endpoint with your API key as a query parameter:

```bash
curl -X GET "https://api.oriondata.io/api/token?apiKey={apiKey}"
```

The response contains a JWT bearer token:

```json
{
  "token": "your_generated_token_here"
}
```

> **Note:**
>
> Bearer tokens are valid for 7 days, but generating a fresh token at the start of each session is recommended.

## Use the bearer token

Include the bearer token in the `Authorization` header of every authenticated request:

```
Authorization: Bearer {token}
```

For example:

```bash
curl -X GET "https://api.oriondata.io/api/UserDevices" \
  -H "Authorization: Bearer $TOKEN"
```

> **Warning:**
>
> Requests to authenticated endpoints without a valid token return a `401 Unauthorized` response. See [API status codes](https://docs.oriondata.io/api/orion-data/v1-3/guides/status-codes/) for the full list.