> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ancestraldev.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Avalex API Authentication: JWT and HTTP Basic Auth

> Avalex supports JWT Bearer tokens and HTTP Basic Auth for protected endpoints. Learn which method to use and how to include credentials in every request.

Every protected Avalex API endpoint requires valid credentials on each request. You include those credentials in the `Authorization` header — either as a short-lived JWT Bearer token or as a Base64-encoded username and password. A small set of public endpoints (such as license validation and login itself) do not require any credentials and can be called freely.

## Authentication Methods

Avalex supports two authentication methods. JWT Bearer tokens are recommended for all real integrations; HTTP Basic Auth is available as a fallback for quick testing.

| Method               | Header Format                   | When to Use                                                |
| -------------------- | ------------------------------- | ---------------------------------------------------------- |
| **JWT Bearer Token** | `Authorization: Bearer <token>` | Recommended for all API clients — stateless and performant |
| **HTTP Basic Auth**  | `Authorization: Basic <base64>` | Fallback; useful for quick tests with curl                 |

## Public Endpoints

The following endpoints do not require authentication and can be called without an `Authorization` header:

* `POST /auth/login` — obtain a JWT token
* `POST /staff/login` — staff-specific login alias
* `POST /staff/register` — create a new staff account
* `POST /licenses/validate` — validate a license key

<Info>
  The Master Admin account always has full access to every endpoint regardless of which authentication method is used.
</Info>

## Next Steps

Choose the authentication method that fits your use case and follow the dedicated guide to get started.

<CardGroup cols={2}>
  <Card title="JWT Authentication" icon="key" href="/auth/jwt">
    Obtain a token via `POST /auth/login` and include it as a Bearer token on every protected call. Recommended for all production integrations.
  </Card>

  <Card title="HTTP Basic Auth" icon="lock" href="/auth/basic-auth">
    Encode your username and password in Base64 and pass them directly in the `Authorization` header. Best for quick testing with curl.
  </Card>
</CardGroup>