> ## Documentation Index
> Fetch the complete documentation index at: https://app.miyon.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorization

> API tokens and scopes.

Every request authenticates with a Bearer token in the `Authorization` header:

```
Authorization: Bearer <your-api-token>
```

Every endpoint uses the same kind of token: a **scoped API token** from the Keys
page. Each token only reaches your own account's agents and data.

## API tokens

Create a token on the **Keys** page of your dashboard ("Generate access token").
The token is shown **once** - copy it right away and store it securely. The Keys
page lists each token's description, scopes, expiry and status afterwards, never
the token itself.

When you generate a token you choose:

* **Scopes** - what the token may do (see below). At least one is required.
* **Expiration** - 30, 90 or 180 days, or no expiry. The default is 90 days. An
  expired token is rejected with `401`; generate a new one before the date.
* **IP whitelist** - optional. Single addresses (`203.0.113.10`) or CIDR ranges
  (`203.0.113.0/24`), IPv4 or IPv6. Empty means the token works from any address.

**Revoke** a token from the Keys page when you no longer need it. Revocation is
immediate and cannot be undone; the token stays listed as revoked.

### Scopes

A scope is `resource:action`. Each endpoint page lists the scope it requires. A
token without that scope receives `403`.

| Resource | Actions | Used by |
| - | - | - |
| `voice_agents` | `read`, `write` | Voice Agents, Voice Agent Settings |
| `tools` | `read`, `write`, `execute` | Tools |
| `conversations` | `read` | Conversations |
| `evals` | `read`, `write` | Eval scenarios |
| `eval_runs` | `read`, `write` | Eval runs |
| `outbound` | `read`, `write` | Outbound Calls |

`resource:*` grants every action of that resource, for example `tools:*` covers
`tools:read`, `tools:write` and `tools:execute`. Grant only what the integration
needs; a token for a reporting job needs `voice_agents:read` and
`conversations:read`, nothing more.

### Failed authentication

A missing, invalid, expired or revoked token returns `401`; a missing scope
returns `403`. Both use a short envelope:

```json theme={null}
{ "error": "Forbidden", "message": "Missing required scope: voice_agents:write" }
```

The `message` is absent on some `403` responses. See
[Errors](/docs/en/api-reference/errors) for the other error formats.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.