> ## Documentation Index
> Fetch the complete documentation index at: https://help.lobyco.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication

> OAuth 2.0 client credentials and API keys, and how to choose between the two tenant setups.

## Authentication schemes

Following authentication schemes is supported:

1. Oauth 2.0 token (client credentials flow​)
2. API Key

## Oauth 2.0 client credentials flow​

This type of authentication is commonly used for server-to-server interactions. Lobyco implements OAuth 2.0 [client credentials](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow) flow using Microsoft identity platform.

### Sequence diagram

<img src="https://mintcdn.com/lobyco-4c9fb3ad/wpdZgjvGMgh4Gbhy/images/299cb47774156a8a3d0bb9d02f43e4ffaa393f93.png?fit=max&auto=format&n=wpdZgjvGMgh4Gbhy&q=85&s=5c38c01671e403048a8ce97d39442069" alt="" width="907" height="536" data-path="images/299cb47774156a8a3d0bb9d02f43e4ffaa393f93.png" />

### Configuration options

<Steps>
  <Step>
    ## [Lobyco tenant setup](/integration/quick-start/api-authentication/lobyco-tenant-authentication-using-client-credentials-flow)

    Lobyco creates an Azure App registration and share credentials with customer.

    This setup is recommended for scenarios where customers don't operate their own Azure AD tenants.
  </Step>

  <Step>
    ## [Multi-tenant setup](/integration/quick-start/api-authentication/multi-tenant-authentication-using-client-credentials-flow)

    Customer imports Lobyco multi-tenant Azure AD app into their local tenant, and creates Azure App registration which enables full control over the secrets.

    This setup is recommended for scenarios where customers operate their own Azure AD tenants.
  </Step>
</Steps>

## API key

While an API key alone isn't the most robust form of authentication, it can still be useful in specific scenarios. For instance, in POS systems, where implementing efficient token management - such as caching and renewing tokens before expiration can be challenging, an API key might offer a practical solution.

As additional security measure, only specific IP addresses can be whitelisted to access Lobyco APIs.