# Authentication (https://docs.developer.commerce.ote-godaddy.com/en/docs/api-users/hosting/authentication)

---
title: Authentication
description: "The Node.js Hosting API uses a Personal Access Token (PAT). Create one in the developer portal, send it as Authorization: Bearer 

## Best practices

- **Never** commit your token to version control. Store it in a secrets manager or your platform's secret store (CI environment variable, Kubernetes secret, and so on).
- **Revoke** a token immediately if it is exposed. Create a replacement with the same scopes.
- PATs expire. Create a new one before the old one lapses — check the expiry date in the [Personal Access Tokens](https://docs.developer.commerce.ote-godaddy.com/personal-access-token) portal.
- Treat `401` as an expired or revoked token, or a missing scope. Check the token expiry first, then verify the required scope is included.
- Log the scope required by a failed operation so you know exactly which scope to add to the next token.