# How to Authenticate (https://developer.godaddy.com/en/docs/api-users/auth/how-to)

***

title: How to Authenticate
description: Step-by-step instructions for generating a Personal Access Token (PAT) or classic developer key to authenticate GoDaddy API calls.
agentNotes:
permissions: \["Any account"]
scopes: \["Not applicable — this page is credential setup"]
rateLimit: "PAT creation: interactive UI, not rate-limited."
idempotent: true
destructive: false
failureRecovery: "PAT reveals once at creation — if lost, revoke and regenerate. Revocation is instant across all edges."
related:
guides:

* title: "Quickstart"
  href: "/docs/api-users/quickstart"
  concepts:
* title: "About Authentication"
  href: "/docs/api-users/auth"
* title: "PAT scopes"
  href: "/docs/api-users/auth#pat-scopes"

***

## Overview

GoDaddy API uses authentication to ensure that only authorized users can access the API. The two authentication methods are using a Personal Access Token (PAT) or the Classic Developer Key. PATs are required for all v3 Domains APIs. The following article provides step-by-step instructions for generating a PAT or classic developer key to authenticate GoDaddy API calls. Go to [About Authentication](https://developer.godaddy.com/docs/api-users/auth) to learn more about the different authentication methods and their scopes.

## Generate, use, and manage tokens

The following sections explain how to generate, use, and manage PATs or classic developer keys to authenticate GoDaddy API calls.

**Personal Access Token (PAT)**

### Generate a token

The following steps explain how to generate a PAT to authenticate GoDaddy API calls.

1. Sign in to the [Personal Access Token](https://developer.godaddy.com/personal-access-token) page.
2. Click **+ Generate Token**.
3. In the **Generate personal access token** dialog, complete the following fields:
   | Field          | Description                             | Note                                                                             |
   | -------------- | --------------------------------------- | -------------------------------------------------------------------------------- |
   | **Name**       | Name for the token.                     |                                                                                  |
   | **Expiration** | Number of days until the token expires. |                                                                                  |
   | **Scopes**     | Scopes for the token.                   | Go to [PAT scopes](https://developer.godaddy.com/docs/api-users/auth#pat-scopes) to see the available scopes. |
4. Click **Generate Token**.

### Store your token securely

After generating the token, it displays once. You can't retrieve it again from the [Personal Access Token page](https://developer.godaddy.com/personal-access-token) and you should store it in secure storage immediately. Don't commit it to source control, check it into a repo, or paste it into chat.

1. In the **Copy your new token** dialog, click the copy icon.
2. Save the token in a password manager, secrets manager, or your application's secure credential store.
3. Load the token at runtime when you need it as a local script in a shell session or as a secret in a secrets store or CI/CD environment variable:

**local script**

```bash
export GODADDY_PAT="<YOUR_GODADDY_PAT>"
```

`export GODADDY_PAT=...` makes the token available to the current shell — it is not a secure place to keep credentials long term. Store the value in a secrets manager first, then export or inject it only when running a command or starting your app.

**secret in a secrets store or CI/CD environment variable**

Inject `GODADDY_PAT` from your platform's secret store (like GitHub Actions secrets or AWS Secrets Manager when the process starts.

### Use a token

The following steps explain how to use a PAT to authenticate GoDaddy API calls.

* Add the header to every request:

```http
Authorization: Bearer ${GODADDY_PAT}
```

### Revoke a token

The following steps explain how to revoke a PAT.

1. Sign in to the [Personal Access Token](https://developer.godaddy.com/personal-access-token) page.
2. Next to the token you want to revoke, click the trash icon.
3. In the **Revoke token?** dialog, click **Revoke Token**.

**Classic Developer Key**

The classic developer key is scheduled for retirement and does not work for v3 Domains APIs. Use a [Personal Access Token](#personal-access-token-pat) instead.

### Generate a key and secret

The following steps explain how to generate a classic developer key and secret to authenticate GoDaddy API calls.

1. Sign in at .
2. Generate a new key for Production.
3. Copy both the **Key** and **Secret** immediately. The Secret is shown once.

### Export the credentials

The following step describes how to export your classic developer key and secret for use in your shell session.

* Export the credentials:

```bash
export GODADDY_KEY="<YOUR_GODADDY_KEY>"
export GODADDY_SECRET="<YOUR_GODADDY_SECRET>"
```

### Use the credential

The following step describes how to use a classic developer key and secret to authenticate GoDaddy API calls.

* Add the header to every request:

```http
Authorization: sso-key ${GODADDY_KEY}:${GODADDY_SECRET}
```