# Authentication

The ROCKIT Edge Backend API supports two authentication methods:
1. Token-based authentication for users accounts.
2. API key-based authentication for machine accounts.

The token-based authentication is typically being applied for interactive clients such as graphical user interfaces while the API-key based authentication method is preferable for integrating the ROCKIT Edge Backend API into existing workflows using machine accounts.
The two authentication methods are described in the following.
`
# Token-based authentication

The ROCKIT Edge API uses a standard refresh-access token pattern, i.e.,

1. [`POST /be/v1/login`](https://edge.api.cloud.rockitplay.com/user-login-org-11611254e0.md)
   Login with user credentials to obtain initial refresh and access tokens
2. [`POST /be/v1/refresh`](https://edge.api.cloud.rockitplay.com/refresh-11630082e0.md)
   Obtain a new refresh and access token. Use the refresh token as bearer token, i.e., add request header `Authorization: Bearer <REFRESH_TOKEN>`
   The previous refresh token is revoked.
3. Authenicate any other endpoint using a valid access token as Bearer token, i.e., add request header `Authorization: Bearer <ACCESS_TOKEN>`
4. [`POST /be/v1/logout`](https://edge.api.cloud.rockitplay.com/user-logout-27659125e0.md)
   Remove the session and revoke refresh token

# API key-based authentication
In order to use the ROCKIT Edge Backend API in an automated environment in most cases it is simpler to create a ROCKIT Edge Backend machine account with the minimum set of necessary permissions for the intended tasks. The returned API Key can than be used for invoking the endpoints along with the username of the machine account as well as the organization name. In addition to the required request header keys of the individual endpoint simply add the following data:


| Key | Description |
| --- | --- |
| x-rockit-orgname | Unique and immutable organization identifier obtained from the ROCKIT Edge administrator. |
| x-rockit-username | The unique and immutable username of the machine account. |
| x-rockit-api-key | The ROCKIT Edge Backend API key obtained when creating the machine user, see `POST /be/v1/users`. |


Note, that the API key-based authentication does not work for endpoints designed for user accounts only, such as
- `POST /be/v1/login` or
- `POST /be/v1/refresh` or
- `POST /be/v1/logout`