> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corbado.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect API authentication

> Authenticate Connect Backend API requests and select operation-specific permissions.

Call the Connect Backend API from your server. Use a Backend API key issued for your Connect project under [**Settings → API keys**](https://app.corbado.com/settings/api-secrets) and keep it in server-side secret configuration.

## Bearer authentication

Versioned Backend API keys can be sent directly as bearer tokens:

```bash theme={null}
curl 'https://backendapi.cloud.corbado.io/v2/connectTokens' \
  --header "Authorization: Bearer $CORBADO_BACKEND_API_KEY"
```

The key must grant the operation's permission and satisfy its expiry and IP restrictions. Observe API keys and Connect tokens are not Backend API credentials.

## HTTP Basic authentication

HTTP Basic authentication is also supported. The username is the project ID and the password is the API secret:

```bash theme={null}
curl 'https://backendapi.cloud.corbado.io/v2/connectTokens' \
  --user "$CORBADO_PROJECT_ID:$CORBADO_API_SECRET"
```

`curl --user` constructs the base64-encoded `projectID:apiSecret` header. Do not send the API secret alone as the Basic credential.

## Permissions

| Operation | Required permission |
| - | - |
| List Connect tokens | `connect_tokens:read` |
| Create, update or delete Connect tokens | `connect_tokens:write` |
| Verify signed passkey data | `passkeys:verify` |
| List or get users | `users:read` |
| Delete a user | `users:write` |
| List passkeys | `credentials:read` |
| Delete a passkey | `credentials:delete` |
| Create or update users | `users:write` |
| Read or manage identifiers | `identifiers:read`, `identifiers:write` |
| Export full credential data | `credentials:export` |
| List or download project exports | `exports:read` |

The permission is also listed on each endpoint. A key with verification permission does not need user deletion permission.

## Client SDKs

Client applications receive action-specific [Connect tokens](/corbado-connect/concepts/connect-token) from your backend. The [frontend protocol](/api-reference/connect/frontend) also uses a process token managed by the SDK. Neither requires exposing Backend API credentials in the client.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.