---
schema_version: "1"
id: 01c69c29d9a2d45afa074558be94be9ae793038dce94a17f185f0abf1a669ab5
title: Authentication
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/analytics/tableau-next-rest-api/guides/authentication.md
canonical_url: https://developer.salesforce.com/docs/analytics/tableau-next-rest-api/guide/authentication.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 7cf76d7a071b77499f422b8206bb1d75414efa81a12465c2c233eed4c5043bca
products:
  - Tableau Next REST API
  - analytics
---
# Authentication

The Tableau Next REST API uses JSON Web Tokens (JWT) for authentication. This ensures secure access to the API endpoints while maintaining stateless authentication.

## Getting Started with Authentication

To authenticate your requests to the Tableau Next REST API:

1. Obtain an API key from your Tableau Next administrator
2. Generate a JWT token using your API key
3. Include the token in the Authorization header of your requests

## API Key Management

Your API key is a sensitive credential that should be kept secure. Best practices include:

- Store API keys in environment variables or secure credential stores
- Never commit API keys to version control
- Rotate API keys periodically
- Use different API keys for development and production environments

## Making Authenticated Requests

Include your JWT token in the Authorization header of your requests:

```bash
curl -X GET https://api.tableaunext.com/v1/dashboards \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"
```

## Token Expiration and Refresh

JWT tokens have an expiration time for security. Your application should:

1. Check token expiration before making requests
2. Refresh tokens before they expire
3. Handle token expiration errors gracefully

## Security Best Practices

To maintain the security of your API access:

- Keep API keys and tokens secure
- Use HTTPS for all API requests
- Implement token refresh logic
- Monitor API usage for suspicious activity
- Follow the principle of least privilege when requesting access scopes