> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leamout.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API clients with organization bearer credentials and understand session-based organization context.

Leamout supports two authentication paths for customer-facing HTTP routes.

## Organization credentials

Server-to-server API clients should use an organization credential:

```http theme={null}
Authorization: Bearer lm_org_...
```

Organization credentials are opaque high-entropy tokens. A generated token begins with `lm_org_`; Leamout stores only a hash and a short non-secret lookup prefix. The plaintext token is returned only when the credential is created.

Each credential belongs to one organization and has explicit scopes. Organization-scoped API middleware maps HTTP reads to `<resource>:read` and mutations to `<resource>:write`.

Examples include:

```text theme={null}
calls:read
calls:write
voice-applications:read
voice-applications:write
trunks:read
trunks:write
carriers:read
carriers:write
```

A bearer credential supplies its own organization context. Do not send `X-Organization-ID` with it to switch tenants; a credential cannot be used to cross its organization boundary.

## Session authentication

The hosted/customer UI uses a session cookie. Session-authenticated organization routes use:

```http theme={null}
X-Organization-ID: <organization UUID>
```

Leamout checks that the signed-in user is a member of the requested organization. Member roles also affect write access: ordinary members are read-only for organization-scoped resource mutations, while deleting an organization is owner-only.

## Which should I use?

Use an **organization credential** for applications, backend services, automation, and API integrations. Use a **session** for interactive user flows such as organization, membership, and API-credential management.

<Warning>
  Never log organization credentials, session cookies, SIP passwords, carrier secrets, webhook signing secrets, TURN credentials, or TLS private keys.
</Warning>