> ## Documentation Index
> Fetch the complete documentation index at: https://developers.gonitro.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials & Authentication

> The two authentication methods of the NSEV WebPortal API - Basic Auth and OAuth 2.0 - and when to use each.

The NSEV WebPortal API supports two authentication methods. Which one you use depends on how your
organization has configured the platform.

Credentials are provisioned by the Nitro delivery team - see
[Platform Access](/docs/nsev/getting-started/basic-setup) if you have not
received yours yet.

## Basic Authentication

Traditional HTTP Basic Authentication using a username and password provisioned for your tenant.

```
Authorization: Basic <base64(username:password)>
```

## OAuth 2.0 (Bearer token)

When your organization has an identity provider (IDP) configured, you authenticate with an OAuth2
access token (a JWT or opaque token) sent as a Bearer token:

```
Authorization: Bearer <access_token>
```

Two OAuth2 flows are available:

* **Client Credentials (machine-to-machine)** - full API access, including administrative
  endpoints. Ideal for server-to-server integrations.
* **Authorization Code (user-based)** - the app acts on behalf of a signed-in user, with that
  user's own permissions (not the full tenant-wide access that Client Credentials grants).
  Administrative endpoints are excluded. Ideal for user-facing applications.

<Note>
  Administrative endpoints (such as `/poisonqueue` and `/absenceperiods`) are
  restricted to machine-to-machine (Client Credentials) authentication.
</Note>

The exact security requirements for each operation are declared in the API Reference. To verify
your credentials work, see
[Make your first call](/docs/nsev/getting-started/first-call).