# Auth of an API User

> The first gate of every call - the token of an API user in x-am-authorization, how to get and refresh it, and what g.req.auth.authAMUser gives your code.

Source: https://docs.apimaker.dev/v1/docs/authorization/AMApiUser.html

Every non-public API needs the token of an [API user](https://docs.apimaker.dev/v1/docs/apis-security/api-user-permission.html) : the application calling. It is the first of the [two gates](https://docs.apimaker.dev/v1/docs/getting-started/how-it-works.html#the-two-gates).

| | |
|---|---|
| Header | `x-am-authorization: <token>` |
| Get it | `POST /api/system-api/<user path>/token` with `{ "u", "p", "expiresInSeconds"? }` |
| Answer | `{ "token", "refresh_token", "expires_in" }` |
| In code | `g.req.auth.authAMUser` : the API user, with its name and groups. |

**Get the token**

```json
{ "u": "default", "p": "12345", "expiresInSeconds": 259200 }
```

**Who is calling**

```typescript
const apiUser = g.req.auth.authAMUser;
g.logger.log(apiUser.name, apiUser.groups);
```

- `expiresInSeconds` is optional : `jwtOptions.expiresIn` of the [configuration](https://docs.apimaker.dev/v1/docs/am-resources/api-maker-configurations.html) otherwise, 72 hours by default. Refresh with `{ "refresh_token" }` while the refresh token is valid (`refreshTokenValidForS` after the token expired, 900 seconds by default).
- The groups of the API user decide which APIs, tables and fields the application reaches. A person token, when the API asks for one, narrows it further.

## Related

- [Get token API](https://docs.apimaker.dev/v1/docs/apis-all/system-apis/system-generated-token-api.html) · [Auth of a database user](https://docs.apimaker.dev/v1/docs/authorization/AMDB.html) · [Handle role based permissions](https://docs.apimaker.dev/v1/docs/authorization/handle-role-based-permissions.html)