# Authentication
Requests to the platform carry a bearer token in an `Authorization` header.

## The header

```http
Authorization: Bearer <token>
```

Send it on every request. The authenticated samples in Getting started read `$AURA_TOKEN` rather than embedding a token. The framework-generated samples on operation pages omit the header, and Try it likewise requires you to add it manually. No artifact this portal generates contains a credential.

## Where the token comes from

Token issuance is deployment-specific. Contact the platform team that owns the gateway for the deployment you are integrating against.

:::note
**Generated clients do not add the header for you**

The 43 published OpenAPI documents declare no `components.securitySchemes` and no `security` block.
So an SDK or client generated from them will not attach `Authorization` on its own —
set the header explicitly in whatever you generate.
:::

## If a call is refused

A credential rejected at the gateway is refused before any service runs, so it raises no platform error code and nothing on an operation page describes it. The status and body the call returns are the account of the refusal; take those to the platform team that owns your gateway.

Failures that DO reach a service are documented on the operation pages: each declares the platform error envelope and the statuses a mapped failure arrives on, and most list the specific codes their handler raises.