---
title: "User authentication"
description: "User authentication creates a session token associated with a project, user, and user level."
canonical: https://docs.ordering.co/api-reference/guides/users-authentication/
---

# User authentication

User authentication creates a session token associated with a project, user, and user level. Send that token only to the Ordering API over HTTPS.

The current authentication operation is:

```text
POST https://api.ordering.co/v400/en/{project}/auth
```

Replace `{project}` with the project code you are authorized to access. The operation can accept email or cellphone credentials, and the current contract also includes one-time-password and device-code fields. Use the request schema in Scalar as the authority for the selected login mode.

## Session response

A successful response can include session data similar to this sanitized fragment:

```json
{
  "result": {
    "session": {
      "access_token": "[REDACTED]",
      "token_type": "bearer",
      "expires_in": 3600
    }
  }
}
```

The values are placeholders. Do not copy tokens from logs, screenshots, or documentation into an application.

## Send the token

Operations protected by bearer authentication expect the `Authorization` header:

```http
Authorization: Bearer YOUR_ACCESS_TOKEN
```

Treat the token as a credential. Keep it out of URLs, source control, analytics, and persistent browser storage unless your security design explicitly requires and protects that storage.

User-level restrictions remain operation-specific. Review the operation's security requirements and the [Users model](https://docs.ordering.co/api-reference/guides/users-model/) before making a request.

## Legacy SDK example

The archived SDK material used a token setter similar to this:

```javascript
ordering.setToken('<access-token>')
```

The archived SDK pages also document a differently named `setAccessToken()` method. Confirm the SDK package and version before relying on either method; the HTTP bearer header is the maintained contract.