# How to authenticate to the LXD API using bearer tokens To authenticate to the LXD API using a bearer token, first create an identity of type `bearer`: CLI ```bash lxc auth identity create bearer/ [[--group ]] ``` The new identity initially has type `Client token bearer (pending)`. A pending identity cannot authenticate but can be added to groups. Next, issue a token for the identity (this changes its type to `Client token bearer`): ```bash lxc auth identity token issue bearer/ [--expiry ] ``` API ```bash lxc query --request POST /1.0/auth/identities/bearer --data '{ "name": "", "type": "bearer", "groups": [ "" ] }' ``` Next, issue a token for the identity: ```bash lxc query --request POST /1.0/auth/identities/bearer//token --data '{ "expiry": "" }' ``` UI Click Permissions in the navigation sidebar, then select Identities from the expanded drop-down list. Click on the + Create identity button to open the side panel. Select Bearer token (Main API). Enter a name and optionally a token expiry for the new identity. Select relevant authentication group(s), then click Create identity. In the modal, click the copy button to copy the token. The returned token can be used to authenticate with LXD. It must be set as a bearer token in the `Authorization` header. You can verify trust by checking the `auth` field in the response metadata of `GET /1.0`: ```bash $ curl -k -H "Authorization: Bearer ${TOKEN}" https:///1.0 { ... "metadata": { "auth":"trusted" } } ``` #### NOTE The `expiry` field accepts multiple space-separated values of the form ``, such as `1d 3H 5M` (1 day, 3 hours, and 5 minutes). Case-sensitive units: years (`y`), months (`m`), weeks (`w`), days (`d`), hours (`H`), minutes (`M`), and seconds (`S`). Note the distinction between months (`m`) and minutes (`M`): for example, `1m` means one month, while `1M` means one minute. Finally, a token that is no longer needed can be revoked: CLI ```bash lxc auth identity token revoke bearer/ ``` API ```bash lxc query --request DELETE /1.0/auth/identities/bearer//token ``` Revoking the token invalidates it immediately and returns the identity to the pending state. The identity has type `Client token bearer (pending)` until a new token is issued for it. The identity remains in its assigned groups, so a newly issued token grants its bearer the same permissions as the revoked one.