# Authentication and permissions

The Content Delivery API uses API Tokens for authentication:

```plaintext
Authorization: Bearer <YOUR-API-TOKEN>
```

You can find your read-only API token in the *Settings > API tokens* section of your administrative area, or generate a new token with more specific permissions:

(Video content)

Regardless of which API token you use, make sure that the "Access the Content Delivery API" or "Access the Content Delivery API in Preview Mode" flags are enabled, otherwise the API token will not be able to make calls to the CDA.

#### Restricting access

If you want to restrict GraphQL access only to a selection of your models, you can generate a custom API token and assign it a custom [role](https://www.datocms.com/docs/general-concepts/roles-and-permission-system.md).

(Video content)

If an API token can only access specific models, any other field **will be completely hidden from the GraphQL schema and response**, eliminating any potential information exposure.

> [!WARNING] Different behavior on legacy projects
> On projects created before January 8, 2024 — and that have not explicitly activated the "Improved GraphQL Security" update — the behavior will be slightly different: you can read all the details in the related [product update](https://www.datocms.com/product-updates/improved-gql-visibility-control.md).

## Related content in "Content Delivery API"

- [Content Delivery API Overview](https://www.datocms.com/docs/content-delivery-api.md)

- [Your first request](https://www.datocms.com/docs/content-delivery-api/your-first-request.md)
- [How to fetch records](https://www.datocms.com/docs/content-delivery-api/how-to-fetch-records.md)

- [API headers (environments, drafts, strict mode, cache tags, content link)](https://www.datocms.com/docs/content-delivery-api/api-endpoints.md)
- [Authentication and permissions](https://www.datocms.com/docs/content-delivery-api/authentication.md)

- [Error codes & handling failures (CDA)](https://www.datocms.com/docs/content-delivery-api/errors.md)
- [Technical Limits (CDA)](https://www.datocms.com/docs/content-delivery-api/technical-limits.md)

- [Complexity](https://www.datocms.com/docs/content-delivery-api/complexity.md)
- [Custom Scalar Types](https://www.datocms.com/docs/content-delivery-api/custom-scalar-types.md)

- [Pagination](https://www.datocms.com/docs/content-delivery-api/pagination.md)
- [Filtering records](https://www.datocms.com/docs/content-delivery-api/filtering-records.md)

- [Deep Filtering](https://www.datocms.com/docs/content-delivery-api/deep-filtering.md)
- [Ordering records](https://www.datocms.com/docs/content-delivery-api/ordering-records.md)

- [Localization](https://www.datocms.com/docs/content-delivery-api/localization.md)
- [Direct vs. Inverse relationships](https://www.datocms.com/docs/content-delivery-api/inverse-relationships.md)

- [Modular content fields](https://www.datocms.com/docs/content-delivery-api/modular-content-fields.md)
- [Structured text fields](https://www.datocms.com/docs/content-delivery-api/structured-text-fields.md)

- [Hierarchical sorting (Tree-like collections)](https://www.datocms.com/docs/content-delivery-api/hierarchical-sorting.md)
- [Images and videos](https://www.datocms.com/docs/content-delivery-api/images-and-videos.md)

- [Filtering uploads](https://www.datocms.com/docs/content-delivery-api/filtering-uploads.md)
- [SEO and favicon](https://www.datocms.com/docs/content-delivery-api/seo-and-favicon.md)

- [Meta fields](https://www.datocms.com/docs/content-delivery-api/meta-fields.md)
- [Cache Tags](https://www.datocms.com/docs/content-delivery-api/cache-tags.md)

- [Changelog](https://www.datocms.com/docs/content-delivery-api/changelog.md)