> ## Documentation Index
> Fetch the complete documentation index at: https://developer.zapsterapi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tokens

> How access tokens work on the Zapster API. Generate a JWT to authenticate and authorize your requests to the WhatsApp API.

### What are tokens?

**Tokens** are pieces of data that represent a permission or an access grant. In the **Zapster API**, tokens are the secure way to authenticate and authorize access to protected resources. They are an alternative to traditional methods like username and password, giving you a more efficient and secure way to manage access to the **Zapster API**.

### What do tokens do?

Tokens play a central role in authentication and authorization inside the **Zapster API**. Their main functions include:

* **Authentication**: tokens verify the identity of a **Zapster API** client. After the initial authentication, a token is generated and can be used to access protected resources without re-sending sensitive credentials like passwords.

* **Authorization**: beyond authenticating, tokens also carry information about a client's rights and permissions, defining which resources or operations it can access or perform on the **Zapster API**.

* **Stateless sessions**: because tokens hold all the information needed for authentication and authorization, the **Zapster API** server can validate requests without keeping client session state. This improves the API's scalability.

### How do tokens work on the Zapster API?

1. **Token generation (JWT)**: the **Zapster API** client generates a JWT (JSON Web Token) through the token management panel at [https://app.zapsterapi.com/tokens](https://app.zapsterapi.com/tokens).

2. **Using the token**: the client stores the token and sends it with every subsequent request to access protected resources of the **Zapster API**.

3. **Token validation**: on each incoming request, the **Zapster API** server validates the JWT. If the token is valid and not expired, the server processes the request and returns the requested data. If the token is invalid or expired, access is denied.

```mermaid theme={null}
sequenceDiagram
    participant Client as Zapster API Client
    participant ZapsterAPI as Zapster API

    Client->>ZapsterAPI: Generates JWT
    Client->>ZapsterAPI: Request with JWT
    ZapsterAPI-->>Client: Validates and returns data
```