# Authentication

Every endpoint in the official Datapublica Business Register API requires a
personal API token and a paid Datapublica plan. Free-plan accounts cannot
create or use API tokens.

## Token model

- A user can have one active personal API token.
- Create, view, or revoke the token in [App settings](https://datapublica.dk/app/settings).
- Requests made with the token resolve to its owner.
- The owner's account status, plan capabilities, and user-level usage limits apply.
- Revocation takes effect for subsequent requests.

The token is a credential. Store it in a secret manager or server-side environment variable. Do not embed it in client-side JavaScript, mobile application bundles, source control, URLs, screenshots, logs, or prompts sent to third parties.

## Bearer header

Send the token in the HTTP `Authorization` header on every API request:

```http
Authorization: Bearer <token>
```

Example:

```bash
curl --get 'https://query.datapublica.dk/api/companies/search' \
  --header "Authorization: Bearer $DATAPUBLICA_API_TOKEN" \
  --data-urlencode 'q=chr'
```

Use HTTPS and the canonical API host `https://query.datapublica.dk`.

## Create and revoke a token

1. Sign in at [datapublica.dk](https://datapublica.dk/login).
2. Open [App settings](https://datapublica.dk/app/settings).
3. Create the token and copy it into secure server-side storage.
4. Return to settings to view the active token or revoke it.

To rotate the credential, revoke the active token and then create a new one. Creating another token while one is active is not available because only one token can be active for a user.

## Authentication failures

Missing, malformed, unknown, or revoked tokens return `401` with an error body:

```json
{
  "error": "Invalid bearer token"
}
```

A missing header returns the same response shape with a message indicating that the bearer token is missing. A suspended owner returns `403`. A token whose owner is on the Free plan also returns `403` with `code: "paid_plan_required"`.

Do not retry `401` responses without correcting or replacing the credential. See [Errors](/docs/errors) for the complete error model.

## Browser and cross-origin requests

The API accepts the `Authorization` header in cross-origin requests. A browser application would expose a personal token to the end user and to client-side code, so call the API from a trusted server unless the token owner explicitly controls that browser environment.

## Support

Use the [support page](https://datapublica.dk/support) for token problems. Share the HTTP status and `x-request-id`, never the token itself.