> ## Documentation Index
> Fetch the complete documentation index at: https://docs.teamcaredental.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate with the TeamCare Vendor API

> Generate your TeamCare API keys from the dashboard, exchange them for a JWT Bearer Token, and include it on every protected API request.

TeamCare Vendor API uses API key pairs and short-lived JWT Bearer Tokens for authentication. You generate keys from the TeamCare dashboard, exchange them for a token, and include that token in the Authorization header of every request.

## Getting your API keys

Before you can call the API, you must generate credentials from the TeamCare web application:

1. Log in to [app.teamcaredental.com](https://app.teamcaredental.com).
2. Navigate to **Settings > Company > Agreement** and accept the Developer API Agreement. Only the account owner can perform this step.
3. Go to **Settings > Company > API Access** and generate your API keys.
4. Copy your `client_id` and `client_secret`. The secret is shown once and cannot be retrieved again.

<Warning>
  Never share your API keys. The client\_secret is displayed only once when generated. If you regenerate keys, the previous credentials are immediately invalidated.
</Warning>

## Requesting a token

To obtain a Bearer Token, send your `client_id` and `client_secret` to the token endpoint.

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST "https://app.teamcaredental.com/api/v1/vendors/auth/token" \
    -H "Content-Type: application/json" \
    -d '{
      "client_id": "YOUR_CLIENT_ID",
      "client_secret": "YOUR_CLIENT_SECRET"
    }'
  ```

  ```python Python theme={null}
  import requests

  response = requests.post(
      "https://app.teamcaredental.com/api/v1/vendors/auth/token",
      json={
          "client_id": "YOUR_CLIENT_ID",
          "client_secret": "YOUR_CLIENT_SECRET"
      }
  )
  token = response.json()["token"]
  ```
</CodeGroup>

### Request parameters

<ParamField body="client_id" type="string" required>
  Your API client identifier, generated in the dashboard.
</ParamField>

<ParamField body="client_secret" type="string" required>
  Your API client secret, shown once during key generation.
</ParamField>

### Response fields

<ResponseField name="token" type="string">
  A JWT Bearer Token valid for 6 hours. Include this in the `Authorization: Bearer <token>` header on all subsequent requests.
</ResponseField>

Example response:

```json theme={null}
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}
```

## Using the token

Include the token in the Authorization header of every request to protected endpoints.

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://app.teamcaredental.com/api/v1/vendors/organizations" \
    -H "Authorization: Bearer YOUR_TOKEN"
  ```

  ```python Python theme={null}
  import requests

  headers = {"Authorization": "Bearer YOUR_TOKEN"}
  response = requests.get(
      "https://app.teamcaredental.com/api/v1/vendors/organizations",
      headers=headers
  )
  print(response.json())
  ```
</CodeGroup>

<Note>
  Cache your token and reuse it for the full 6 hour lifetime. Calling the token endpoint for every request will exhaust the 10 requests per minute per IP limit and cause avoidable 429 errors.
</Note>

## Token expiry

Tokens expire after 6 hours. When a token expires, requests will return a 401 Unauthorized error. Re-request a token using the same client\_id and client\_secret, then update the Authorization header in your application.

There is no refresh token flow. Simply call the token endpoint again with your original credentials to receive a new Bearer Token.