# Tokens and authentication

> How apps authenticate with bot tokens, and how to reset and revoke them.

Apps authenticate with a **bot token**. Webhooks don't use tokens: their secret URL is the credential (see [Webhooks](https://lammapp.sa/developers/webhooks)).

## Bot tokens

A token looks like this:

```
lmb1_1234567890123456789_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789abcdefg
```

Send it on every REST request in the `Authorization` header, with the word `Bot` in front:

```http
GET /v1/users/@me HTTP/1.1
Host: lammapp.sa
Authorization: Bot lmb1_…
```

On the gateway, send it in the `identify` message instead (see [Gateway](https://lammapp.sa/developers/gateway)).

- Tokens work only on `/v1`. Lamma refuses a bot token everywhere else, and ignores sign-in cookies on `/v1`.
- Lamma stores only a hash of the secret part, so it can't show a token again. Copy it when it is made.
- A missing token answers `401 bot_token_required`, a wrong or revoked one `401 bot_token_invalid`, and a token for a switched-off or deleted app `403 application_disabled`.

## Resetting a token

In **User Settings › Developer**, open the app and select **Reset token**. For safety, this needs a sign-in within the last ten minutes.

At most two tokens are live at once. After a reset, the previous token keeps working for one hour, so a running bot can switch over without going offline. To cut off every token at once, select **Revoke all tokens**: open gateway connections close within ten seconds.

> [!WARNING]
> Never put a token in code you share, in a Git repository, in a screenshot or in a chat. Load it from an environment variable or a secrets manager. If you think it leaked, revoke all tokens straight away.

## Session cookies and the product API

Lamma's own app uses routes under `/api/` with a sign-in cookie. Those routes are for people, not bots: they aren't part of this API and can change at any time. The only `/api/` routes meant for developers are the [webhook URLs](https://lammapp.sa/developers/webhooks).