> ## Documentation Index
> Fetch the complete documentation index at: https://docs.artosai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta JWT Authentication

> Use an Okta access-token JWT with Artos in a single-tenant environment.

# Okta JWT Authentication

In a single-tenant environment, use your organization's Okta access token to authenticate Artos API requests.

## Send the token

```http theme={null}
Authorization: Bearer <okta-access-token>
```

Example:

```bash theme={null}
curl "https://api.artosai.com/get-one-document" \
  -H "Authorization: Bearer $OKTA_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"document_id":"DOCUMENT_ID"}'
```

## Use an access token, not an ID token

Okta can issue multiple token types. Use the access token whose audience is the Artos API. Do not send an ID token as the API Bearer credential.

## User and organization access

The token identifies the signed-in user. Artos uses that identity to apply the user's organization and resource permissions to each request.

A valid Okta token does not automatically grant access to every Artos resource. The user must also have permission to access the requested document, template, or file.

## Open a source file

File-listing responses contain an opaque `resource_id`, for example:

```json theme={null}
{
  "name": "protocol.pdf",
  "resource_id": "sourcefile-org-id/documents/protocol.pdf"
}
```

When the user opens the file, use the authenticated source-file route or the
SDK's `openFile({ viewer: 'apryse' })` method. Source files are authorized with
the user's Bearer token on each read; they do not use a document-file session.

## Troubleshooting

* `401 Unauthorized`: obtain a new Okta access token and verify that it is sent as `Authorization: Bearer ...`.
* `403 Forbidden`: ask your Artos administrator to grant the signed-in user access to the resource.
* `404` or an unavailable file: refresh the file listing and use the current `resource_id`.