# Authenticate requests

> Send a personal access token to Management API routes.

Canonical page: https://rpc.aurpay.net/docs/management-api/authentication

The production Management API base URL is `https://rpc-dash.aurpay.net/api`. Send the PAT as a Bearer credential to a `/v2` route:

```bash
export RPC_GATEWAY_API_URL='https://rpc-dash.aurpay.net/api'
export RPC_GATEWAY_PAT='<personal-access-token>'

curl "$RPC_GATEWAY_API_URL/v2/apps" \
  -H "Authorization: Bearer $RPC_GATEWAY_PAT"
```

Keep the PAT in a secret manager or protected environment variable, with redaction enabled for source-control checks, command history, logs, URLs, and support requests.

Use the PAT as the request's sole authentication credential.

A successful request returns HTTP `200` in the [Management API response envelope](https://rpc.aurpay.net/docs/management-api/errors.md). Then [select only the scopes your client needs](https://rpc.aurpay.net/docs/management-api/scopes.md).