# Authorization

To make secure calls to the THEOlive REST API, both authentication and authorization are required. THEOlive uses token–secret pairs to authorize API requests and ensure secure access.

## 1. Getting a token-secret pair

To generate a token–secret pair, you must first have an account on the [THEOlive management console](https://console.theo.live/).

1. Navigate to the *Developers section* and click on "Tokens".
2. Click the "Generate Token" button.
3. Enter a name for your token.
4. Click "Generate" to create the token–secret pair.

![](/pr-863/assets/images/c0aca77-1.-THEOlive-console-generate-token-adbe2de4b5bc32272e38d30cf5f2f843.PNG)

This will open a pop-up displaying your token "key" and its corresponding secret.

![](/pr-863/assets/images/bb9b4a6-2.-THEOlive-console-generated-token-and-secret-162a8966ab2d79d35b2af87b63cef4ce.PNG)

> **Please store the secret**
>
> Make sure to securely store the secret, as it will only be shown once. THEOlive stores a hashed version of the secret, meaning it cannot be recovered afterward.

Once you close the pop-up window, the new token will be visible in your list of active tokens.

![](/pr-863/assets/images/5361242-3.-THEOlive-console-token-list-c724d365a813752794596c659ca6a3b7.PNG)

If you forget your secret or if it gets exposed, you can easily regenerate a new token–secret pair at any time.

To revoke a token, click the arrow icon under the "Actions" column and the token will be moved to the list of revoked tokens after confirmation.

## 2. Using the token-secret pair with Basic Authentication

THEOlive uses Basic Authentication for API requests. To authenticate, include your token-secret pair (base64-encoded) in the 'Authorization' header, prepended with the word 'Basic'.

Here’s an example of how to set up the header:

1. Combine your token and secret in the format `token:secret`. Example: `my-token:my-secret`

2. Base64 encode the combined value. Example: `bXktdG9rZW46bXktc2VjcmV0`

3. Include the encoded string in the Authorization header, prefixed with the word Basic. Example header: `Authorization: Basic bXktdG9rZW46bXktc2VjcmV0`

4. The final Authorization header should look like this: `Authorization: Basic bXktdG9rZW46bXktc2VjcmV0`

You’re now ready to make authenticated requests to the THEOlive API.