# API Authentication

Axiad Mesh APIs require authenticated, tenant-scoped requests. This page covers
the auth model at a high level; the full generated endpoint reference (delivered
by a separate story) documents each operation's specifics.

## Auth model

- Axiad Mesh APIs use **OAuth2** for authentication.
- Requests are **tenant-scoped**: you only ever access data belonging to your
  own tenant.
- Multi-tenant isolation is enforced by the platform.

## Required headers

Authenticated requests include a bearer token obtained through the standard
OAuth2 flow.

```http
Authorization: Bearer <access-token>
Accept: application/json
```

## Where to go next

- The **API Reference** section (generated from published OpenAPI specs)
  documents endpoints, schemas, and per-service details.
- See the [Admin Guide](../admin-guide/index.md) for tenant and access
  configuration.