> ## Documentation Index
> Fetch the complete documentation index at: https://absentify.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate requests to the absentify API using an API key, Microsoft Entra ID bearer token, or Authorization Bearer header for connector clients.

<Note>
  You can find your API key in the absentify Dashboard. Keep this key private to ensure the security of your account.
</Note>

<Warning>
  Do not share your API key in public areas, such as GitHub repositories, client-side code, or anywhere it might be exposed to unauthorized users.
</Warning>

The absentify API supports three ways to authenticate a request:

1. **API key** — passed as the `x-api-key` header or as the `apiKey` / `api_key` query parameter.
2. **Bearer token (Microsoft Entra ID)** — a signed Microsoft Entra ID JSON Web Token (JWT) passed as `Authorization: Bearer <token>`. This is the method used by the absentify Power Automate connector.
3. **Bearer value (API key)** — an API key passed as `Authorization: Bearer <api-key>` for clients that only support Bearer-style authentication.

If an explicit API key is present (header or query), it is always used. Otherwise, absentify inspects the value of the `Authorization: Bearer ...` header. A JWT-shaped value is validated as a Microsoft Entra ID token; any other value is treated as an API key.

If your API key is ever compromised, you can regenerate it in the absentify Dashboard to secure your account data.

### API key

Include your API key as the `x-api-key` header on every request. Examples in multiple languages are shown below.

<CodeGroup>
  ```python request_example.py theme={null}
  import requests

  url = "https://api.absentify.com/api/v1/example_endpoint"
  api_key = "your_api_key_here"

  headers = {
      "x-api-key": api_key,
      "Content-Type": "application/json"
  }

  response = requests.get(url, headers=headers)
  print(response.json())
  ```

  ```javascript requestExample.js theme={null}
  const fetch = require('node-fetch');

  const url = "https://api.absentify.com/api/v1/example_endpoint";
  const apiKey = "your_api_key_here";

  const headers = {
      "x-api-key": apiKey,
      "Content-Type": "application/json"
  };

  fetch(url, { headers })
      .then(response => response.json())
      .then(data => console.log(data))
      .catch(error => console.error('Error:', error));
  ```

  ```bash request_example.sh theme={null}
  curl -X GET "https://api.absentify.com/api/v1/example_endpoint" \
  -H "x-api-key: your_api_key_here" \
  -H "Content-Type: application/json"
  ```
</CodeGroup>

### Explanation

1. **Set up the API URL**: Define the API endpoint you want to access.
2. **Add headers**: Include your `x-api-key` and set `Content-Type` to "application/json".
3. **Send the request**: Execute the request and process the JSON response.

<Note>
  Replace `"https://api.absentify.com/api/v1/example_endpoint"` with the specific API endpoint you need, and `"your_api_key_here"` with your actual API key.
</Note>

### Bearer token (Microsoft Entra ID)

The API also accepts a Microsoft Entra ID (Azure AD) token in the `Authorization: Bearer <token>` header. This path is designed for the absentify Power Automate connector, which passes the signed-in user's Microsoft identity token automatically. No API key needs to be stored in the connector configuration.

When a Bearer token is validated, the request runs in the context of the absentify member linked to the Microsoft user who issued the token.

**Requirements for the token:**

* Signed by Microsoft Entra ID and issued via the AAD v1 endpoint (`https://sts.windows.net/<tenant-id>/`).
* Audience (`aud`) set to the absentify Power Automate app (`4dce2abf-3f8e-4281-9f7a-d602fc391886` or `api://4dce2abf-3f8e-4281-9f7a-d602fc391886`).
* Contains a valid tenant id (`tid`) and object id (`oid`).

<Warning>
  The Microsoft user must have signed in to absentify at least once before Bearer token authentication can be used. The sign-in links the Microsoft object id to an absentify account — without this link, the request is rejected with a `401 Unauthorized`.
</Warning>

<Info>
  If a Bearer value is not a JWT, the API treats it as an API key. This lets clients that only support `Authorization: Bearer ...` continue to work with a standard absentify API key.
</Info>

#### Example request

```bash bearer_example.sh theme={null}
curl -X GET "https://api.absentify.com/api/v1/example_endpoint" \
-H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIs..." \
-H "Content-Type: application/json"
```