> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getgriffinapp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication

> Authenticating with the Griffin Hub API

All API requests (except the health check endpoint) require authentication.

## API key authentication

For self-hosted hubs with `AUTH_MODE=api-key`, include the API key in the `Authorization` header:

```bash theme={null}
curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://hub.griff.services/monitor
```

API keys are configured on the hub via the `AUTH_API_KEYS` environment variable. Generate a key with:

```bash theme={null}
griffin auth generate-key
```

## OIDC authentication

For hubs with `AUTH_MODE=oidc` (including Griffin Cloud), include a JWT token from the configured OIDC provider:

```bash theme={null}
curl -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  https://hub.griff.services/monitor
```

OIDC tokens include `organizationId` and `role` claims that determine access scope.

## Error responses

Unauthenticated requests return `401`:

```json theme={null}
{
  "statusCode": 401,
  "error": "Unauthorized",
  "message": "Missing or invalid authorization header"
}
```