# Authentication

## Personal Access Tokens

Create one from **Settings → Personal Access Tokens** in the app, then pass it:

```ts
import { Layer } from '@layer_ai/sdk'


const layer = new Layer({ apiKey: 'pat_...' })
```

With no `apiKey`, the SDK reads `LAYER_API_KEY` from the environment where a runtime has one — which is how a CI job, a render farm, or a scheduled task authenticates without the token reaching the source:

```ts
const layer = new Layer()
```

See [authentication](/docs/authentication) for the permission model a token inherits.

## OAuth access tokens

Pass a function instead of a string and it is called per request, so a token that expires mid-session is refreshed without rebuilding the client:

```ts
const layer = new Layer({ apiKey: () => session.getAccessToken() })
```

In the browser

A Personal Access Token is long-lived and carries your full account permissions. Anything running in a browser should hold a short-lived OAuth access token instead, obtained through your own sign-in flow.

## Choosing a workspace

Every call runs against one workspace. Name it on the client:

```ts
const layer = new Layer({ apiKey, workspaceId: '…' })
```

Or per call, which wins over the client’s:

```ts
await layer.projects.list({ workspaceId: '…' })
```

With neither, the first call that needs a workspace resolves one from the credential. That works when the credential reaches exactly one workspace; when it reaches several the SDK asks you to name one rather than picking. To see them:

```ts
for await (const workspace of layer.workspaces.listAll()) {
  console.log(workspace.workspace_id, workspace.name)
}
```

## Pointing at another deployment

```ts
const layer = new Layer({ apiKey, baseUrl: 'https://api.app.layer.ai/api' })
```

That is the default. Override it only to reach a non-production deployment.

## Identifying your integration

An integration that names itself shows up as itself in Layer’s API metrics, which is what lets us tell you about a change that affects it:

```ts
const layer = new Layer({ apiKey, userAgent: 'unity-bridge/2.1' })
```

It is appended to the SDK’s own `User-Agent`, never replacing it.