---
title: "Authentication"
description: "Keyless endpoints, API tokens, and scopes — how INBIO API requests authenticate."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.in.bio/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

INBIO has two tiers of API access, and the first one needs no credentials at
all.

## Keyless endpoints — no auth

These work without an account, a key, or a token:

| Endpoint | What it does |
| --- | --- |
| `POST /api/shorten` | [Shorten a URL](/api/free-shorten) |
| `GET /api/qr` | [Generate a styled QR code](/api/free-qr) |

Send nothing but the request. Abuse is controlled with
[rate limits](/rate-limits), not accounts.

## API tokens — the full REST API

Everything under `https://in.bio/api/v1` uses **bearer tokens**:

```
Authorization: Bearer <token>
Accept: application/json
```

1. Create an account at [in.bio/register](https://in.bio/register). API
   access is included in the **Pro** and **Business** plans.
2. Go to **Settings → API tokens** and create a token, selecting the scopes
   it should carry.
3. Keep it secret — tokens are shown once. Revoke and re-create if leaked.

### Scopes

Token abilities act as scopes; a token can only do what was selected at
creation:

| Scope | Grants |
| --- | --- |
| `links:read` | List/read links, QR codes, folders, tags |
| `links:write` | Create, update, delete, enable/disable, bulk create |
| `analytics:read` | Per-link analytics |

Requests missing a scope return `403` with `error.type = "scope"` and the
required scope named in the response.

## Errors you'll meet

| Status | Meaning |
| --- | --- |
| `401` | Missing or invalid token |
| `403` `error.type=plan` | Your plan doesn't include API access |
| `403` `error.type=scope` | Token lacks the required scope |
| `404` | Resource doesn't exist — or isn't yours (never `403`) |

## For AI agents

Agents authenticate exactly the same way — a human creates the token, the
agent sends the header. The [MCP server](/mcp-server) forwards your
`Authorization` header to the API, and machine-readable instructions live at
[in.bio/auth.md](https://in.bio/auth.md). There is no OAuth flow and no
programmatic registration — that's deliberate, and documented honestly.

Source: https://docs.in.bio/authentication/index.mdx