# Direct - Authentication

.sc-doc-table table { table-layout: auto; width: 100%; }
table th, table td { word-break: keep-all; overflow-wrap: normal; padding: 8px 14px; vertical-align: top; }
table th:first-child, table td:first-child { white-space: nowrap; }
table td code, table th code { white-space: nowrap; }
Authenticate your backend to the Direct API and mint per-user **preauth tokens** that the widget or your client app exchanges for a user access token.
**Authentication.** `POST /direct/login` accepts API key + secret. All other endpoints require a Direct API host token (Bearer JWT obtained from `/direct/login`).
**Token lifetimes.**
- **Direct API token** — short-lived; refresh via `GET /direct/refresh-token` before it expires.
- **Refresh token** — returned alongside the Direct token; use to obtain a fresh access token without re-presenting credentials.
- **Preauth token** — single-use, **30-second** lifetime. Generate immediately before sending to the widget/client.

 - [POST /direct/login](https://crsintegration.redocly.app/client-spec/direct-authentication/login.md): Authenticates a customer host using API key and secret credentials, returning a JWT access token and a refresh token. The access token must be included as a Bearer token in the `Authorization` header
 - [GET /direct/preauth-token/{id}](https://crsintegration.redocly.app/client-spec/direct-authentication/preauthtoken_1.md): Generates a short-lived pre-auth token for the specified user. **Parameters:** The `{id}` path parameter is the user's unique identifier (UUID). **Flow:** The returned token is used to establish a use
 - [GET /direct/refresh-token](https://crsintegration.redocly.app/client-spec/direct-authentication/refreshtoken.md): Exchanges a valid refresh token for a new access token and refresh token pair. **Parameters:** Pass the refresh token as the `token` query parameter. **Requirements:** The host must be active. **Expir