> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stateset.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Token-based auth for the StateSet Cloud REST and GraphQL APIs, and connecting source control.

# Authentication

StateSet Cloud exposes both a **REST** and a **GraphQL** API. Both use token-based
authentication.

<Warning>
  **All data in StateSet is private by default.** You must authenticate to read or write anything —
  there is no anonymous read.
</Warning>

## The model

Include a token with every request. Each token identifies a **user** authenticated to your
StateSet instance, so a request is authenticated when the backend can securely determine which
user and device is making it. That's what lets the platform:

* Attribute the action to a user
* Check that the user is permitted to perform it

Tokens are issued for signed-in users. You can also generate them from your Cloud account with a
per-user, variable expiry.

## Sending a token

```bash theme={null}
curl https://api.stateset.com/v1/projects \
  -H "Authorization: Bearer $STATESET_API_KEY"
```

Or store it once with the CLI:

```bash theme={null}
stateset cloud login --api-key $STATESET_API_KEY
stateset cloud whoami
```

<Tip>
  `whoami` is the fastest way to answer "which identity is this token?" — useful when a request
  returns data you didn't expect, or nothing at all.
</Tip>

See [API Keys](/cloud-api-reference/api-keys) for creating, rotating, and revoking them.

## Connecting source control

Cloud deploys from your Git provider, so the first step is linking an account. Sign up at
`cloud.stateset.com`, then click **Add New**.

### 1. Connect GitHub or GitLab

Authorize the provider that hosts your code. This lets Cloud manage serverless functions and
deployments directly from your repository.

### 2. Import the project

Select the repository or project you want to deploy.

### 3. Create the serverless project

Choose a [project type and runtime](/cloud-api-reference/overview#project-types) and Cloud
scaffolds the deployment.

<Note>
  Connecting source control grants Cloud read access to the repository, including its history. If
  credentials were ever committed, rotate them — and keep runtime secrets in
  [Action secrets](/cloud-api-reference/overview#managing-an-action) rather than in the repo.
</Note>

## Related

* [API Keys](/cloud-api-reference/api-keys)
* [Cloud Overview](/cloud-api-reference/overview)
* [Secrets API](/cloud-api-reference/secrets/get)