Every non-public method requires a bearer token in the `Authorization` header:

```
Authorization: Bearer <token>
```

peinture accepts two kinds of bearer token there — a short-lived **access token** for interactive sessions, and a long-lived **personal access token** for scripts and other apps.

## Access & refresh tokens

Call [`auth.login`](/docs/methods/auth.login) with an email and password to receive a pair:

- an **access token** — a JWT with a 15-minute lifetime, sent as `Authorization: Bearer <token>` on every call;
- a **refresh token** — used to obtain a new pair without re-entering the password.

Refresh proactively before the access token expires. On a `token_expired` (`1002`) error, call [`auth.refresh`](/docs/methods/auth.refresh) once with your refresh token and retry the original request. Refresh tokens slide on each use up to a 90-day absolute session cap, after which the user must log in again.

[`auth.logoutAll`](/docs/methods/auth.logoutAll) revokes every session for the user — every issued access and refresh token, including the one making the call.

## Personal access tokens

To authorize another application without sharing your password, mint a **personal access token** (PAT) with [`token.create`](/docs/methods/token.create). Send it exactly like an access token — `Authorization: Bearer pnt_…` — but it never needs refreshing: it stays valid until it expires (if you set an expiry) or you revoke it.

- The secret (`pnt_…`) is shown **once** at creation; only a hash and a short hint are stored.
- A PAT is **never** an admin token and may call **only** the `image.*` methods plus the upload and archive HTTP routes. Everything else returns `forbidden` (`1003`).
- Revoke a PAT individually with [`token.revoke`](/docs/methods/token.revoke); it does not affect your other tokens or your password sessions.

The `token.*` and `account.*` methods are self-management and are reachable **only** with a password-session access token, never a PAT.