---
stoplight-id: qm828iyzpzl1a
---

# Authentication

Cynet APIs use access tokens to authenticate requests.

To get an access token, an API user needs to be created in the Cynet system. The API user provides the **Access-Key** and **Secret-Key** which are used to authenticate to the Cynet API. For information on creating an API user, see [API Users in the Cynet Documentation](https://help.cynet.com/en/articles/297-api-users).<br>
Use this account in the [GET token API call](https://help.api.cynet.com/docs/cynet/branches/main/48af3a8192f80-get-token) to generate an access token. The access token is used as as an authorization header with **Auth Type - Bearer Token** to authenticate every API call to the Cynet 360 server.

![Authorization.png](../assets/images/Authorization.png)

Every user can have one valid API token at a time.<br>

## Token Expiration (Timeout)

The timeout period (or expiration) for the API token can be set in the Cynet Console by going to **Settings** > **Users & Roles** > **Settings** and setting the Inactivity Logout Time.

Note that API tokens will remain valid for this duration from the time of issuance, regardless of usage.

![Inactivity Logout Time.png](<../assets/images/Inactivity Logout Time-3.png>)

### On-Premesis API Reference

If you are an on-prem user, go to [On-Prem Cynet 360 API Reference](https://help.api.cynet.com/docs/cynet/iah0dsbmetd0e-welcome-to-cynet-api-reference).