> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corbado.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect API authentication

> Authenticate Connect Backend API requests and select operation-specific permissions.

Call the Connect Backend API from your server. Use a Backend API key issued for your Connect project and keep it in server-side secret configuration.

## Bearer authentication

Versioned Backend API keys can be sent directly as bearer tokens:

```bash theme={null}
curl 'https://backendapi.cloud.corbado.io/v2/connectTokens' \
  --header "Authorization: Bearer $CORBADO_BACKEND_API_KEY"
```

The key must grant the operation's permission and satisfy its expiry and IP restrictions. Observe API keys and Connect tokens are not Backend API credentials.

## HTTP Basic authentication

HTTP Basic authentication is also supported. The username is the project ID and the password is the API secret:

```bash theme={null}
curl 'https://backendapi.cloud.corbado.io/v2/connectTokens' \
  --user "$CORBADO_PROJECT_ID:$CORBADO_API_SECRET"
```

`curl --user` constructs the base64-encoded `projectID:apiSecret` header. Do not send the API secret alone as the Basic credential.

## Permissions

| Operation                               | Required permission                     |
| --------------------------------------- | --------------------------------------- |
| List Connect tokens                     | `connect_tokens:read`                   |
| Create, update or delete Connect tokens | `connect_tokens:write`                  |
| Verify signed passkey data              | `passkeys:verify`                       |
| List or get users                       | `users:read`                            |
| Delete a user                           | `users:write`                           |
| List passkeys                           | `credentials:read`                      |
| Delete a passkey                        | `credentials:delete`                    |
| Create or update users                  | `users:write`                           |
| Read or manage identifiers              | `identifiers:read`, `identifiers:write` |
| Export full credential data             | `credentials:export`                    |
| List or download project exports        | `exports:read`                          |

The permission is also listed on each endpoint. A key with verification permission does not need user deletion permission.

## Client SDKs

Client applications receive action-specific [Connect tokens](/corbado-connect/concepts/connect-token) from your backend. The [frontend protocol](/api-reference/connect/frontend) also uses a process token managed by the SDK. Neither requires exposing Backend API credentials in the client.