# Client

**URL:** https://heroiclabs.com/docs/satori/api/client/
**Keywords:** client, satori
**Categories:** satori, client, api

---


# Client API

## Authentication

The Satori Client API authenticates with an [API key](../../concepts/settings/#api-keys).

Requests follow two steps:

1. **Authenticate.** Call `POST /v1/authenticate` with your API key passed as the username in an HTTP Basic Authentication header and an empty password. The response returns a session token and a refresh token.
2. **Call the API.** Send the session token as a Bearer credential in the `Authorization` header on every other endpoint.

See [client libraries](../../client-libraries/) for concrete code examples.

Two endpoints differ from the pattern above:

- `GET /v1/flag` and `GET /v1/flag/override` accept either an API key or a session token. The reference shows both as required. Only one is needed.
- `POST /v1/server-event` uses Basic Authentication with an API key. See [Server events](../../guides/server-events/).

<!-- This file is located on static/specs/-->
{{< swagger spec="specs/client_satori_heroic_docs.swagger.yaml" >}}