# API Authentication

Canonical URL: https://doc.roote.ai/roote-api/api-authentication



ROOTE API requests use the developer token described in [Authentication](/authentication).

## Bearer authentication [#bearer-authentication]

```http
Authorization: Bearer YOUR_API_TOKEN
```

Bearer is the default for persistent integrations. Endpoints that explicitly document query-token compatibility may also accept `?token=YOUR_API_TOKEN`.

## Access policies and scopes [#access-policies-and-scopes]

An endpoint can require authentication and a scope:

* `geography:read` for geography capabilities;
* `mobility:read` for mobility and urban services.

Access policy, scope checks, credits, and limits are enforced by the backend. See [Credits & Limits](/roote-api/credits-and-limits).

<Callout title="Complete guide" type="info">
  Token creation, MCP sharing, and URL-exposure considerations are documented on [Authentication](/authentication).
</Callout>