Authentication¶
Every request outside a small set of public endpoints carries a credential:
An account is a prerequisite
Both methods authenticate an existing identity; neither creates one. Accounts are granted by invitation and cannot be self-registered — see Get started.
There are two ways to be authenticated, and which one applies depends on what is making the request rather than on any choice you configure.
| Device code flow | Browser sessions | |
|---|---|---|
| For | CLIs, CI, scripts, applications | People signed in through a browser |
| Credential | Bearer token | session_id cookie |
| Sent as | Authorization header |
Automatically by the browser |
| Obtained by | Approving a device code | Signing in to the portal or /reference |
| Renewable from a script | Yes, with a refresh token | No |
If you are writing a client, use the device code flow. The cookie cannot be obtained without a browser sign-in, cannot be moved between clients, and cannot be renewed from a script.
The header always wins
If a request carries both an Authorization header and a session cookie,
the header is used and the cookie is ignored — so an explicit token always
overrides whatever the browser happens to be carrying.
Identity¶
Identity is currently provided by Okta, exclusively. That is an implementation detail of the approval step; your client only ever talks to the Taiga Cloud API, and never needs an Okta client of its own.
Accounts cannot be self-registered — see Identity Providers for who can create one and what would change if further providers are supported.
Trying it without writing code¶
/reference has a Sign in button that authenticates you in the browser and attaches a token to any request you send from the page. Useful for exploring an endpoint before scripting it.
When authentication fails¶
A 401 means the credential is the problem — missing, expired or malformed.
Get a new one: refresh if you still hold a valid refresh token, otherwise run
the device code flow again, or sign in again in the browser.
A 403 means the credential is fine but your role does not cover the action.
A new token will not help; access has to be granted on the customer or
project.
The full status code list is in /reference.