How it works
- Mechanism: Auth0. Both the Data API and Data Downloader require a registered, authenticated user account — the same account used to log into Data Hub.
- Token issuance: self-service. You generate a personal access token from the Developer section of your account settings.
- Scope: user-scoped, not org-scoped. A token grants exactly the same data access your account already has — across variables, metered entities, visualizations, dashboards, and data sources — rather than a separate scope chosen at creation time. If your account has permissions on more than one organization, a single token reflects all of them; there’s no need to generate one token per organization.
- Access control: which variables are public, restricted, or private is configured and controlled by Data Hub — not by the token itself.
Open: exactly how a request scopes results when a user’s token spans multiple organizations isn’t fully decided yet — see Discovery Endpoints for the current thinking.
Authenticate a request
This page is a stub for the confirmed token generation UI steps, token expiry/rotation behavior, and the exact 401/403 error response shape — those haven’t been finalized in the source spec yet.