---
title: Authentication
seo:
  description: Set up access to the Holst API using a personal access token with the required scopes.
---

Holst API uses personal access tokens to authenticate and authorize requests. Calling an API operation requires both of the following:

- **Token scope** — the token has the scope required to call the API operation.
- **Token owner's permissions** — the user who created the token is allowed to perform the requested action. Scopes do not expand the user's permissions.

Create a separate token for each integration and select only the scopes it needs.

## Create a personal access token

1. Sign in to Holst.
2. On the page that lists your boards, click your name or avatar in the lower-left corner, then select **Account Settings**.
3. Under **Personal access tokens**, click **Create token**.
4. Enter a descriptive name such as `Audit event export`.
5. Select the required scopes and choose an expiration option.
6. Click **Create token**.

**Important:** the token is displayed only once. Copy it immediately and store it securely.

## Authenticate API requests

Include the token in the `Authorization` header of every request using the `Bearer` scheme:

```http
Authorization: Bearer holst_pat_...
```

## Available scopes

<div className="auth-scopes-table">

| Scope | Description |
| --- | --- |
| `organization:audit_events_read` | Allows the token to retrieve audit events for organizations where its owner is an administrator. |

</div>

## Access errors

<div className="auth-errors-table">

| Status | Meaning |
| --- | --- |
| `401 Unauthorized` | The token is missing, malformed, expired, revoked, or otherwise invalid. |
| `403 Forbidden` | The token lacks the required scope, or its owner does not have permission to perform the requested operation. |

</div>