> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pushctl.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Pushctl API requests with scoped application bearer tokens.

Send an application token in every request:

```http theme={null}
Authorization: Bearer push_live_your_token
```

Tokens belong to one application. A valid token cannot read or change another application's resources.

## Required abilities

| Ability               | Operations                          |
| --------------------- | ----------------------------------- |
| `installations:write` | Register and update an installation |
| `installations:read`  | Get an installation                 |
| `notifications:send`  | Send a notification                 |
| `notifications:read`  | List and get notifications          |
| `events:write`        | Report a delivery event             |

<Warning>Bearer tokens are credentials. Store server tokens in a secret manager, keep them out of URLs and logs, and never put send-capable tokens in mobile code.</Warning>

## Rotation

Create a replacement token with the same or narrower preset, deploy it, confirm successful requests, then revoke the old token from **Application settings**. Revocation is immediate.