> For the complete documentation index, see [llms.txt](https://docs.january.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.january.ai/rest-api/authentication.md).

# Client tokens

Your backend mints short-lived client tokens with its API key so apps never hold the key. [How authentication works](/docs/authentication.md#your-token-endpoint) describes the endpoint your backend adds: mint only for a signed-in user, and take `end_user_id` from that user's session, never from the request.

## Client-token scopes

A client token can call only the operations its scopes allow; anything else fails with `403 scope_insufficient`. An app's January client uses one token for every call, so request the scopes of every feature your app uses, and no others.

| Scope                 | Operations                                                                                            |
| --------------------- | ----------------------------------------------------------------------------------------------------- |
| `foods:read`          | [Foods](/rest-api/foods.md): autocomplete, search, barcode lookup, get a food, and alternatives       |
| `restaurants:read`    | [Restaurants](/rest-api/restaurants.md): restaurant search, menu-item search, and a restaurant's menu |
| `food_analysis:write` | [Food analysis](/rest-api/food-analysis.md): image, text, and corrections                             |
| `food_logs:read`      | [Food logs](/rest-api/food-logs.md): list, summary, and get                                           |
| `food_logs:write`     | [Food logs](/rest-api/food-logs.md): create, update, and delete                                       |
| `water_logs:read`     | [Water logs](/rest-api/water-logs.md): list daily totals                                              |
| `water_logs:write`    | [Water logs](/rest-api/water-logs.md): create and delete                                              |
| `weight_logs:read`    | [Weight logs](/rest-api/weight-logs.md): list daily weights                                           |
| `weight_logs:write`   | [Weight logs](/rest-api/weight-logs.md): create                                                       |
| `glucose:read`        | [Glucose prediction](/rest-api/glucose.md)                                                            |

Minting and revoking client tokens, and reading [Credits](/rest-api/credits.md), accept only an API key.

Each operation's description states what it costs — see [Credits and pricing](/rest-api/credits-and-pricing.md).

{% openapi src="<https://partners.january.ai/v1.2/openapi.json>" path="/v1.2/auth/client-tokens" method="post" %}
<https://partners.january.ai/v1.2/openapi.json>
{% endopenapi %}

{% openapi src="<https://partners.january.ai/v1.2/openapi.json>" path="/v1.2/auth/client-token-revocations" method="post" %}
<https://partners.january.ai/v1.2/openapi.json>
{% endopenapi %}