> ## Documentation Index
> Fetch the complete documentation index at: https://developer.quicko.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Quicko Connect uses a two-tiered authentication system to secure API interactions

Quicko Connect uses a two-tiered authentication system to secure API interactions and ensure that only authorised users can access sensitive data:

1. **API User Access Token**: Required to interact with OAuth APIs. This token authenticates your application as a trusted client.
2. **Resource Owner Access Token**: Used to authenticate requests to Open APIs. This token represents the user's consent and is obtained through the OAuth flow.

## Acquiring API User Access Token

To use Quicko's OAuth APIs, you need an API User Access Token:

<Steps>
  <Step title="Authentication Endpoint">
    Call the `/authenticate` endpoint with your API credentials (key and secret).
  </Step>

  <Step title="Environment-Specific Credentials">
    <Columns cols={2}>
      <Card title="Test Environment" icon="flask">
        Use credentials starting with `key_test_...` and `secret_test_...`.
      </Card>

      <Card title="Production Environment" icon="rocket">
        Use credentials starting with `key_live_...` and `secret_live_...` for both key and secret.
      </Card>
    </Columns>
  </Step>
</Steps>

## Best Practices for Security

<AccordionGroup>
  <Accordion title="Keep Credentials Secure" icon="shield-check" defaultOpen>
    Store your API keys and secrets securely and never expose them in public repositories or client-side code.
  </Accordion>

  <Accordion title="Use HTTPS" icon="lock">
    Ensure all API requests are made over HTTPS to protect data in transit.
  </Accordion>

  <Accordion title="Handle Errors Gracefully" icon="triangle-alert">
    Implement error handling for authentication failures and other API errors.
  </Accordion>
</AccordionGroup>

<Card title="Acquiring Resource Owner's Access Token" icon="book">
  You can read about the OAuth workflow, which details the process to acquire this token.
</Card>