# Public API authentication

# Public API authentication

The Costfluent Public API accepts organization tokens beginning with `cf_org_` and workspace tokens beginning with `cf_ws_`. Tokens are credentials: keep them out of source control, logs, browser bundles, and shared documents.

## Create a token

In Costfluent, open **Settings → API tokens**, create a token, select the smallest set of capabilities your integration needs, and set an expiry where practical. Copy the token immediately; its full value is shown only once.

Cost Report integrations can request read, create, update, and delete capabilities. Subscription operations use separate read and manage capabilities.

## Send a request

Pass the token with the standard Bearer authorization scheme:

```bash
curl --request GET \
  --url https://api.costfluent.com/v1/cost-reports \
  --header "Authorization: Bearer $COSTFLUENT_API_TOKEN"
```

Use production tokens only with `https://api.costfluent.com`. The development endpoint at `https://api.costfluent.dev` is protected by Cloudflare Access.

## Use the playground safely

The [API reference](/api) includes an interactive playground. Select the correct server, authorize with a scoped token, and review the request before sending it. Write and delete operations affect live workspace data on the selected server.