> For the complete documentation index, see [llms.txt](https://eventx-hq.gitbook.io/knowledge-base/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eventx-hq.gitbook.io/knowledge-base/api-v2/authentication-organizer-api-token-org-event-scoped-not-user.md).

# Authentication — Organizer API Token (Org / Event Scoped, Not User)

All `Event`, `Attendee`, and `/mcp` endpoints authenticate with an **organizer API token** — not a user JWT.

#### Token Format

Send the token on every request as:

```
Authorization: Bearer evtx_live_<secret>
```

* Secret shape: `evtx_live_` (10-char prefix) followed by a 43-char base64url secret (32 random bytes) — e.g. `evtx_live_9k3…cB1`.
* `x-api-key: evtx_live_…` is also accepted as an alternative header.
* The token must begin with the `evtx_` prefix or it is rejected with `401`.

#### Provisioning

Tokens are created in the **Organiser Portal → API Tokens** (`portalRoutes.userPortalApiTokens`).

The raw secret is **shown only once** at creation. Subsequent reads return only `prefix` and `last4` for display.

#### Scope

* **`scope='org'`** → `token.organization_id === event.organization_id`; grants access to **all events in the organization**.
* **`scope='event'`** → `token.event_id === eventId`; grants access to **only that single event**. An event-scoped token **cannot** call the org-only `GET /v2/events` list endpoint.

Scope enforcement is **pure token-level** — it never consults `userId`, `user_org_assignment`, or attendee `roleTags` (`event-auth.ts` is bypassed for these routes).

#### Permissions

* **`read`** → GET requests only.
* **`write`** → implies `read`; allows POST / PUT / PATCH / DELETE (checked via `isWriteMethod`).

#### Validation & Errors

A token is rejected when `is_enabled=false`, `deleted_at` is set, or `expires_at` is in the past. Failure modes:

* `401` `ERR_PUBLIC_API_UNAUTHORIZED` — missing, malformed, expired, or revoked token.
* `403` `ERR_PUBLIC_API_FORBIDDEN` — token valid but wrong org/event scope, or `read`-only token used on a write method.

Legacy `POST /auth` JWT exchange (`user:{userId}:{secret}` → `Bearer JWT` 1h) remains for backward compat on tickets/addons, but `Event`/`Attendee` prefer direct `organizer_api_token` Bearer.