---
title: Authentication
slug: authentication
eyebrow: Getting started
nav_group: Getting started
nav_label: Authentication
nav_order: 20
---

# Authentication

Every request authenticates with two headers: a **Client ID** and a **Token**.

Your Client ID is permanently bound to your account and never changes. Your Token can be rotated at any time for security — find and regenerate both on your [token page](https://streamscharts.com/api/token).

| Header | Description |
| --- | --- |
| Client-ID | Account identifier. Fixed for the life of your account. |
| Token | Secret access key. Rotatable from the token page. |

```curl REQUEST
curl -X GET https://streamscharts.com/api/v2/channels/shroud?platform=twitch \
  -H 'Client-ID: XXXXXXXXXXXX' \
  -H 'Token: YYYYYYYYYYYYYY'
```

> [!WARNING] Keep your Token secret
> Treat the Token like a password. Never expose it in client-side code, public repositories, or browser requests. If a Token leaks, rotate it immediately from the token page — your Client ID stays the same.

An invalid or missing credential returns `401 invalid_credentials`. See [Errors](/api/docs/errors) for the full list.