> ## Documentation Index
> Fetch the complete documentation index at: https://firmngin.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Workspace API tokens, scopes, and SDK keys

## Workspace API tokens

Generate a token in **Dashboard → Integrations → Generate Token**. Pick a name and the scopes the token needs. The full token is shown **once**, so copy it right away.

Send the token in the `Authorization` header:

```bash theme={null}
curl https://api.firmngin.dev/api/saas/v1/devices/{device_id}/locations/latest \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

The `X-API-Key: <YOUR_API_TOKEN>` header is also accepted.

A token belongs to one workspace and can only reach devices in that workspace. Revoking a token in **Integrations** stops it immediately.

> [!WARNING]
>
> Keep API tokens on your server or in CI secrets. Never put them in browser code, mobile apps, or firmware.

### Scopes

| Scope | Dashboard label | Allows |
| - | - | - |
| `devices:control` | Device control | [Send device commands](https://firmngin.dev/docs/api-reference/devices/commands.md) |
| `entities:read` | Entity history | [Entity state history](https://firmngin.dev/docs/api-reference/devices/history.md#entity-state-history) |
| `locations:read` | Device location | [Location history](https://firmngin.dev/docs/api-reference/devices/history.md#location-history) |
| `ota:read` | Firmware update history | [Firmware update history](https://firmngin.dev/docs/api-reference/devices/history.md#firmware-update-history) |
| `alarms:read` | Alarms | [Alarm rules and events](https://firmngin.dev/docs/api-reference/devices/alarms.md) |
| `devices:inventory` | Device inventory | [Device ownership](https://firmngin.dev/docs/api-reference/devices/ownership.md) |
| `devices:provision` | Device provisioning | [Provisioning](https://firmngin.dev/docs/api-reference/devices/provisioning.md) and [firmware lookup](https://firmngin.dev/docs/api-reference/firmware/lookup.md) |
| `firmware:deploy` | Firmware OTA | [Firmware upload](https://firmngin.dev/docs/api-reference/firmware/upload.md) |

Give each token only the scopes it needs. A token can also be limited to specific device templates.

## Publishable SDK key

The [Device Billing SDK](https://firmngin.dev/docs/api-reference/device-billing/sdk.md) runs in the browser, so it uses a separate **publishable** key that can only read the menu and create checkouts for one merchant.

Find it in **Dashboard → Integrations → Browser SDK access**, together with the **SDK merchantId** and the list of **Allowed origins**. Send both values on every request:

```
X-API-Key: <PUBLISHABLE_SDK_KEY>
X-Merchant-ID: <SDK_MERCHANT_ID>
```

Requests are accepted only from the browser origins you add to **Allowed origins**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.