---
description: >-
  This page contains some common questions and answers about using the
  authentication methods available for the Ideon API.
---

# Authentication

## _Which authentication methods are available for the Ideon Enrollments API?_

* Basic Authentication
  * To authenticate, pass the API Key as `Vericred-Api-Key` in the headers of  your API calls.
  * compact example&#x20;
    * `curl -H 'Vericred-Api-Key: YOUR_KEY' "https://enrollments.vericred.com/groups"`
* Token-based Authentication&#x20;
  * To authenticate, POST to /auth/token to fetch a token
  * Place this token in the optional header `Authorization: Bearer {YOUR_TOKEN}`.
    * example:
      * `curl -H 'Vericred-Api-Key: YOUR_KEY' -X POST "https://enrollments.vericred.com/auth/token"`
      * `curl -H 'Authorization: Bearer {YOUR_TOKEN}' "https://enrollments.vericred.com/groups"`



## _Do tokens expire? How long is a token 'active'?_

* Tokens come with an expiration of 1 day, the exact date & time is returned in the response.&#x20;
* Whether you should request a new JWT token with every API call hinges on your design approach.
* However, there is no issue with calling for a token each time or for every API call session.&#x20;
* For instance, if you are sending over a new group with coverage periods, members, etc., you can request the token once if you are sending all the information simultaneously, or before batches of requests.

## _Do I need to use Token-based Authentication?_

* Token based ("oauth") is preferred not yet required by any endpoints in the Ideon API
* Our basic authentication method is secure for use in your integration

## _For which API calls should I provide this header?_

* You will be required to send this on each API call of each type.&#x20;
* This is to ensure that the correct account is associated securely with the data. &#x20;

## _Does Ideon's API have any limits on Requests sent?_

* You might experience a brief 429 error if your operations exceed 1500 calls every 5 minutes
* Our preference is that customers try to limit to less than 1000 calls per minute

