> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ozura.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API reference for Vault authentication — API keys, JWT, and auth endpoints.

Vault supports **API key** authentication (server-to-server) and **JWT** authentication (dashboard and management). **POST /tokenize** requires **X-Pub-Key** when using a production vault API key; test/sandbox API keys do not require it. Some requests support **hybrid** (API key + JWT for user attribution).

## API key

**Header:** `X-API-Key: <your_api_key>`

**Use for:** Tokenization, proxy, verify key. For **POST /tokenize** you must also send **X-Pub-Key** when using a production vault API key. Test/sandbox API keys do not require X-Pub-Key.

**Endpoints that accept API key:**

| Endpoint                  | Permission                                     |
| ------------------------- | ---------------------------------------------- |
| POST /tokenize            | tokenization (+ X-Pub-Key for production keys) |
| POST /proxy/transaction   | tokenization                                   |
| POST /test-tokens         | tokenization (+ X-Pub-Key for production keys) |
| GET /api/applications/key | any (verify key)                               |

API key format may vary (e.g. provisioned keys); docs often show keys starting with `key_` as an example. Never expose API keys in client-side code.

## JWT

**Header:** `Authorization: Bearer <jwt>` or cookie (after login).

**Use for:** Dashboard and management — projects, applications, audit logs, user settings, MFA. JWT is required for management endpoints (projects, applications, audit logs, token management, user settings); [Applications](/api-reference/vault/applications) also documents the verify-key endpoint (API key).

### Auth endpoints (explicit paths)

| Method | Path                         | Description                                   |
| ------ | ---------------------------- | --------------------------------------------- |
| POST   | /auth/login                  | Email/password login, returns JWT             |
| POST   | /auth/logout                 | Log out                                       |
| GET    | /auth/verify                 | Validate current JWT                          |
| POST   | /auth/change-password        | Body: current\_password, new\_password (JWT)  |
| POST   | /auth/forgot-password        | Body: email                                   |
| GET    | /auth/verify-reset-token     | Query: token                                  |
| POST   | /auth/reset-password         | Body: token, new\_password                    |
| POST   | /auth/reset-expired-password | Body: token, current\_password, new\_password |
| GET    | /auth/password-expiry-info   | JWT                                           |
| POST   | /auth/send-verification-code | Email verification flow                       |
| POST   | /auth/verify-email-code      | Verify email code                             |
| POST   | /auth/register               | Registration (when email verification used)   |
| POST   | /auth/mfa/verify             | Body: code                                    |
| POST   | /auth/mfa/verify-backup      | Backup code                                   |
| POST   | /auth/mfa/disable            | Body: code                                    |
| GET    | /auth/mfa/status             | MFA status                                    |
| GET    | /auth/mfa/verify-page        | MFA verify page                               |
| GET    | /mfa-status                  | Root path for MFA status                      |

**MFA setup** is via **POST /user/settings/mfa** (toggle/setup); response can include `totp_uri` and `backup_codes` when enabling. There is no separate /auth/mfa/setup path.

## Hybrid

Send both `X-API-Key` and `Authorization: Bearer <jwt>`. The API key authorizes the request; the JWT identifies the user for audit logging (e.g. on tokenize or proxy).

## Verify API key

See [GET /api/applications/key](/api-reference/vault/verify-api-key) to validate a key and read its project and permissions.

## Base URL

Use the [Vault base URL](/api-reference/vault/overview) (sandbox or production).