> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gvb-staging.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Obtain and protect bearer tokens.

Every request requires `Authorization: Bearer YOUR_TOKEN` and `Accept: application/json`. Tokens are created and revoked from GVB's authenticated **API Access** page. Use a service account for unattended integrations and grant only the tenants and permissions it needs.

Tokens are secrets. Store them in a managed secret store, rotate them after suspected exposure, and never include them in query strings, browser storage, logs, generated documentation, or client-side applications.