---
title: Authentication
description: Create an API key, exchange it for a bearer token, and call the API.
---

Every request to the API must carry a bearer token. Tokens are minted from an **API client**
(your API key) — a `client_id` / `client_secret` pair you create from your Deepfire account.

## 1. Create an API key

Sign in to [app.deepfire.co](https://app.deepfire.co) and go to **Settings → API clients →
Create**. Give the key a name you will recognize later.

## 2. Exchange it for a token

```bash
curl -s -X POST "https://api.deepfire.co/v1/token" \
  -H "Content-Type: application/json" \
  -d "{\"client_id\": \"$DEEPFIRE_CLIENT_ID\", \"client_secret\": \"$DEEPFIRE_CLIENT_SECRET\"}"
```

```json
{
  "access_token": "token...",
  "expires_in": 15552000,
  "token_type": "Bearer"
}
```

## 3. Call the API

```bash
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.deepfire.co/ogc/features/v1/collections?f=application/json"
```

## Token lifetime

Cache the token and re-use it until it expires (`expires_in` is in seconds) rather than
exchanging on every call. There are no refresh tokens: when it expires, run the exchange again
with the same `client_id` / `client_secret`.