> ## Documentation Index
> Fetch the complete documentation index at: https://docs.communityhub.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Data API Authentication

> The Data Hub Data API authenticates via Auth0-issued, user-scoped personal access tokens — not API keys with configurable scopes or client-credential exchange.

<Warning>
  This page previously described API-key scopes (`read`/`write`/`admin`), an OAuth client-credential token-exchange flow, and a fake base URL. None of that is the real design.
</Warning>

## How it works

* **Mechanism**: Auth0. Both the Data API and Data Downloader require a registered, authenticated user account — the same account used to log into Data Hub.
* **Token issuance**: self-service. You generate a personal access token from the Developer section of your account settings.
* **Scope**: user-scoped, not org-scoped. A token grants exactly the same data access your account already has — across variables, metered entities, visualizations, dashboards, and data sources — rather than a separate scope chosen at creation time. If your account has permissions on more than one organization, a single token reflects all of them; there's no need to generate one token per organization.
* **Access control**: which variables are public, restricted, or private is configured and controlled by Data Hub — not by the token itself.

<Note>
  **Open:** exactly how a request scopes results when a user's token spans multiple organizations isn't fully decided yet — see [Discovery Endpoints](/api-reference/query/saved-queries) for the current thinking.
</Note>

## Authenticate a request

```bash theme={null}
curl -H "Authorization: Bearer <token>" \
  "https://api.communityhub.cloud/dh/public/v1/variables"
```

<Note>
  This page is a stub for the confirmed token generation UI steps, token expiry/rotation behavior, and the exact 401/403 error response shape — those haven't been finalized in the source spec yet.
</Note>