> For the complete documentation index, see [llms.txt](https://alek-cora-glez.gitbook.io/odoo-generic-api/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alek-cora-glez.gitbook.io/odoo-generic-api/authentication.md).

# Authentication

## ***Authentication***

***The authentication is made by Json Web Tokens** (using PyJWT library)...*

`PyJWT` is a Python library which allows you to encode and decode JSON Web Tokens (**JWT**). JWT is an open, industry-standard ([RFC 7519](https://tools.ietf.org/html/rfc7519)) for representing claims securely between two parties.

{% embed url="<https://pyjwt.readthedocs.io/en/stable/>" %}

***Request...***

```
curl --location --request GET 'https://<server_url>/auth' \
    --header 'user: <user>' \
    --header 'password: <password>'
```

***Response...***

```
{
    "token": "<token>"
}
```

*The obtained token will be used for the subsequent requests to the server. In case of authentication error (for Search, Create, Update and Delete) you can obtain the following error:*

```
{
    "jsonrpc": "2.0",
    "id": null,
    "result": {
        "status_code": 401,
        "error": "Signature expired. Please log in again."
    }
}
```

## Authorization

*In case the authenticated user does not have access to perform a certain action, the proper error message will be shown. Below an example...*

```
{
    "jsonrpc": "2.0",
    "id": null,
    "result": {
        "status_code": 400,
        "error": "You are not allowed to create 'Country' (res.country) records.\n\nThis operation is allowed for the following groups:\n\t- Administration/Settings\n\nContact your administrator to request access if necessary."
    }
}
```