# Auth of an API User

> The first gate of every call - the token of an API user in x-am-authorization, how to get and refresh it, and what g.req.auth.authAMUser gives your code.

Source: https://docs.apimaker.dev/v4/docs/authorization/AMApiUser.html

Every non-public API needs the token of an [API user](https://docs.apimaker.dev/v4/docs/apis-security/api-user-permission.html) : the application calling. It is the first of the [two gates](https://docs.apimaker.dev/v4/docs/getting-started/how-it-works.html#the-two-gates).

| | |
|---|---|
| Header | `x-am-authorization: <token>` |
| Get it | `POST /api/system-api/<user path>/token` with `{ "u", "p", "expiresInSeconds"? }` |
| Answer | `{ "token", "refresh_token", "expires_in" }` |
| In code | `g.req.auth.authAMUser` : the API user, with its name and groups. |

**Get the token**

```json
{ "u": "default", "p": "12345", "expiresInSeconds": 259200 }
```

**TypeScript**

**Who is calling**

```typescript
const apiUser = g.req.auth.authAMUser;
g.logger.log(apiUser.name, apiUser.groups);
```

**Python**

**Who is calling**

```python
api_user = g.req.auth.authAMUser
g.logger.log(api_user.name, api_user.groups)
```

**PHP**

**Who is calling**

```php
$apiUser = $g->req->auth->authAMUser;
$g->logger->log($apiUser->name, $apiUser->groups);
```

**C#**

**Who is calling**

```csharp
var apiUser = g.Req.Auth.GetObject("authAMUser");
g.Logger.Log(apiUser.GetString("name"), apiUser["groups"]);
```

**Go**

**Who is calling**

```go
apiUser := g.Req.Auth().Map("authAMUser")
g.Logger.Log(apiUser.String("name"), apiUser.List("groups"))
```

**Rust**

**Who is calling**

```rust
let api_user = &g.req.auth()["authAMUser"];
g.logger.log(format!("{} {}", api_user["name"], api_user["groups"]));
```

**Java**

**Who is calling**

```java
JsonObject apiUser = g.req.getAuth().getObject("authAMUser");
g.logger.log(apiUser.getString("name"), apiUser.getList("groups"));
```

**Kotlin**

**Who is calling**

```kotlin
val apiUser = g.req.auth.getObject("authAMUser")
g.logger.log(apiUser.getString("name"), apiUser.getList("groups"))
```

- `expiresInSeconds` is optional : **Tokens Expire After** of the [Deployment Settings](https://docs.apimaker.dev/v4/docs/am-resources/api-maker-configurations.html#security-apis) otherwise, 72 hours by default. Refresh with `{ "refresh_token" }` while the refresh token is valid (`refreshTokenValidForS` after the token expired, 900 seconds by default).
- The groups of the API user decide which APIs, tables and fields the application reaches. A person token, when the API asks for one, narrows it further.

## Related

- [Get token API](https://docs.apimaker.dev/v4/docs/apis-all/system-apis/system-generated-token-api.html) · [Auth of a database user](https://docs.apimaker.dev/v4/docs/authorization/AMDB.html) · [Handle role based permissions](https://docs.apimaker.dev/v4/docs/authorization/handle-role-based-permissions.html)