> ## Documentation Index
> Fetch the complete documentation index at: https://docs.briksync.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication

> How authentication works for the BrikSync PropOS API and web application.

The BrikSync PropOS API currently uses **browser session authentication** for all routes. When you log in to the web application, a session is issued and managed automatically — you do not need to handle tokens manually.

All HTTP endpoints that require authentication validate the active session on each request. There is no Bearer token or API key scheme in the current release.

***

## Session-based authentication

The BrikSync web application authenticates users through browser sessions managed by the platform. This applies to:

* The BrikSync dashboard and all browser-based workflows
* OAuth and email verification callbacks

When you are signed in, your session is attached to every request automatically. You do not need to set any headers manually when using the web application.

***

## Programmatic API access (Business plan)

Programmatic API access — including API key generation and management — is a **Business plan** entitlement. Organisations on the Business plan can view their API integration status from the **API Access** page in the sidebar.

<Note>
  API key issuance and lifecycle management (generate, revoke, rotate) are not yet available. This
  capability is on the roadmap. To be notified when it launches, contact us at
  [hello@errsol.com](mailto:hello@errsol.com).
</Note>

***

## Authentication errors

If your session is missing or expired, requests to protected routes will redirect to the sign-in page. HTTP routes return a bare error object:

```json theme={null}
{
  "error": "Unauthorized"
}
```

If your session is valid but your account does not have permission to perform the requested action:

```json theme={null}
{
  "error": "Forbidden"
}
```

***

## Session-based auth best practices

* **Sign in only on trusted devices.** Sessions are tied to the browser that initiated them.
* **Sign out when done on shared devices.** Use the sign-out option in the user menu.
* **Enable MFA on your account.** Multi-factor authentication adds a second layer of protection. See the [Security settings](/account/security) guide.

***

## Next steps

Explore the available HTTP endpoints in the [API Overview](/api/overview).

***

Built by [Errsol Technologies LLP](https://errsol.com)