---
updatedAt: 2025-06-02T21:39:05.000Z
agentTools:
  projectIndex: https://developers.evrythng.com/llms.txt
---

# Authentication

Access to the EVRYTHNG API is achieved using HTTPS requests to the `https://api.evrythng.io/v2` domain. A combination of API key, URL validation, and roles and permissions determines the validity of each request.

All API requests must use one of the secure `https`, `mqtts`, or `wss` protocols. Devices requiring extra configuration for TLS use the certificates available on the [*Security*](https://developers.evrythng.com/docs/security) page.

***

## Authenticating Requests

Every request to our API must (unless otherwise stated) contain a valid API key in the `Authorization` HTTP header to identify the user or application issuing the request and execute it if authorized.

Here is an example of an API request that returns a list of Thngs. The `Authorization` header is sent in the request.

```curl Authenticate with a header
curl -i -H "Accept: application/json" \
  -H "Authorization: $APPLICATION_USER_API_KEY" \
  -X GET "https://api.evrythng.io/v2/thngs"
```

Instead of sending the API key in the `Authorization` header, you can append `?access_token=$OPERATOR_API_KEY` to any URL in the API:

```curl Authenticate with query parameter
curl -i -H "Accept: application/json" \
  -X GET "https://api.evrythng.com/thngs?access_token=$OPERATOR_API_KEY"
```

For JavaScript developers, [evrythng.js](https://developers.evrythng.com/docs/javascript-sdks) only requires you to initialize a scope object with the right API key:

```javascript Authenticate as an operator
// User key
const OPERATOR_API_KEY = 'AGiWrH5Ote...';

const operator = new evrythng.Operator(OPERATOR_API_KEY);

operator.init().then(() => {
 operator.product().read()
  .then(console.log)
  .catch(console.log);
});
```