> ## Documentation Index
> Fetch the complete documentation index at: https://integration.hunterai.uz/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> A long-lived, read-only Bearer token is what the adapter implements. OAuth 2.0 is available on request but not built today.

## Bearer token (required)

The adapter authenticates with a single static **Bearer token**. You issue HunterAI a
dedicated, read-only token scoped to the endpoints in this spec, and HunterAI sends it on
every request:

```http theme={null}
Authorization: Bearer <token>
Accept: application/json
```

There is no login step, no token exchange, and no refresh flow — the token is sent as-is
until you rotate or revoke it.

<Note>
  Issue a token that can **only read** the seven endpoints in this spec. HunterAI never
  writes to your CRM, so a read-only token is sufficient and is the correct least-privilege
  choice.
</Note>

### How HunterAI stores your token

* The token is written to the connection record and **encrypted at rest** with Fernet
  (AES-128-CBC + HMAC). It is never stored in plaintext.
* It is **write-only through the API**: the onboarding endpoints accept a token but never
  return it in any response. Once saved, it cannot be read back — only replaced.

### Rotating the token

Rotation is a straight replacement, with no downtime if you overlap the two tokens:

<Steps>
  <Step title="Issue a new token">
    Generate the replacement in your CRM. Keep the old one valid for the moment.
  </Step>

  <Step title="Update the connection">
    Your HunterAI business owner PATCHes the connection with the new token
    (see [Go live](/guides/connecting)). The next sync uses it immediately.
  </Step>

  <Step title="Revoke the old token">
    Once a sync has succeeded on the new token, revoke the old one.
  </Step>
</Steps>

### Revoking access

Revoke the token in your CRM at any time. The next HunterAI request receives
[`401`](/errors#401-unauthorized) and the sync stops — no data is written on our side
from an unauthenticated call. Revoking the token is the supported way to cut HunterAI off
without deleting the connection.

<Warning>
  When a token becomes invalid, **every entity fails with an auth error** on the next
  sync. Nothing is partially ingested from that run. Your business owner sees the sync
  marked *failed* with an authentication message in HunterAI. See
  [Errors → 401](/errors#401-unauthorized).
</Warning>

## OAuth 2.0 (on request, not implemented today)

<Warning>
  **OAuth is not implemented by the adapter.** The client sends a static Bearer token and
  performs no authorization-code exchange, no token refresh, and no `client_id`/`client_secret`
  handshake. Do not build against an OAuth flow expecting it to work today.
</Warning>

If your CRM already speaks OAuth 2.0 and cannot issue a long-lived token, HunterAI can
support an OAuth profile **on request** as a professional-services engagement. It is not
part of the v1.0 self-service adapter and has no committed timeline.

If you need it, raise it with HunterAI **before** you start building — the default and
only path the adapter implements today is the static Bearer token above.