> ## Documentation Index
> Fetch the complete documentation index at: https://docs.backapp.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

Send `X-App-Key` and `X-App-Version` to each operation in this reference. The AppKey identifies your mobile app and can ship with it. Keep provider credentials and administrative secrets on the server.

Register a device with `POST /v2/auth/device` and a JSON body containing `device_id`. Save the returned `access_token` and `refresh_token` securely. Send the access token as `Authorization: Bearer <access_token>` on protected requests.

When the access token expires, call `POST /v2/auth/refresh` with the same app headers and a JSON body containing `refresh_token`. Replace both stored tokens with the returned pair. Tokens are bound to the app that obtained them. If you receive `token_app_mismatch`, check that the AppKey and tokens belong to the same app.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.