> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowforma.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate calls to the FlowForma Governance API using an Azure AD bearer token or a FlowForma integration access token.

The FlowForma Governance API accepts two kinds of credential. Which one you use depends on the endpoint.

<CardGroup cols={2}>
  <Card title="Azure AD bearer token" icon="key">
    Used by most endpoints (environments, environment requests, processes, security templates, settings). Obtained from an Azure AD app registration.
  </Card>

  <Card title="Integration access token" icon="shield">
    Required by the Process Actions and API Connections endpoints. Copied from FlowForma Settings.
  </Card>
</CardGroup>

All requests are made against the base URL `https://api.flowforma.com`.

## Azure AD bearer token

Most endpoints authenticate with an Azure AD app-only access token.

<Steps>
  <Step title="Register an Azure AD app">
    Create an app registration with the `Sites.Read.All` Microsoft Graph application permission and a client secret. Follow the [App Registration](/developers/flowforma-governance-api/app-registration) guide. Note the **Application (client) ID**, **Directory (tenant) ID**, and **client secret**.
  </Step>

  <Step title="Request a token">
    Call the token endpoint with those three values as query parameters:

    ```bash theme={null}
    curl "https://api.flowforma.com/v1/oauthToken?appId=YOUR_CLIENT_ID&appSecret=YOUR_CLIENT_SECRET&tenantId=YOUR_TENANT_ID"
    ```

    The response body is the access token.
  </Step>

  <Step title="Call the API">
    Send the token in the `Authorization` header using the `Bearer` scheme:

    ```bash theme={null}
    curl "https://api.flowforma.com/v1/environments" \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
    ```
  </Step>
</Steps>

The API resolves your tenant from the token, so no tenant identifier is needed on individual calls.

## Integration access token

The **Process Actions** and **API Connections** endpoints require a FlowForma integration access token instead of a bearer token. If you send a bearer token to these endpoints, the request is rejected.

<Steps>
  <Step title="Copy the token">
    In your FlowForma environment, open **FlowForma Settings** and copy the integration access token.
  </Step>

  <Step title="Call the API">
    Send the token as the raw `Authorization` header value, with no `Bearer` prefix:

    ```bash theme={null}
    curl -X POST "https://api.flowforma.com/v1/processActions/createForm" \
      -H "Authorization: YOUR_INTEGRATION_ACCESS_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{ "FlowFormaURL": "https://contoso.sharepoint.com/sites/flow", "FlowId": "12" }'
    ```
  </Step>
</Steps>

<Note>
  The integration access token is sent without the `Bearer` prefix. The Azure AD token is sent with it. Using the wrong one for an endpoint results in an error.
</Note>