# Authenticate your calls

### Create your organization[​](#create-your-organization "Direct link to Create your organization")

To get access to the Nabla API, please reach out to <api@nabla.com>.

Your server key gives full access to your organization and thus should be held secret and never embedded in a front-end application.

### Choose between *Server API* and *User API*[​](#choose-between-server-api-and-user-api "Direct link to choose-between-server-api-and-user-api")

You can authenticate in two different ways:

#### From your servers (Server API)[​](#from-your-servers-server-api "Direct link to From your servers (Server API)")

Simply use the server key you generated as the bearer token in requests you make to paths under <https://api.nabla.com/v1/copilot-api/server>.

#### From your front-end apps (User API)[​](#from-your-front-end-apps-user-api "Direct link to From your front-end apps (User API)")

Front-end applications will authenticate their calls to Nabla Copilot API using ephemeral access tokens that are scoped to a user in your organization.

From your server (thus using the Server API) do the following:

* [Create a user](/2024-04-22/server/create-copilot-user.md).
* [Authenticate the user](/2024-04-22/server/jwt-authenticate-user.md) you just created.
* Communicate the pair of `access_token` and `refresh_token` to your front-end app.
* Your front-end app now can use the ephemeral `access_token` to make calls to the same endpoints but under `/copilot-api/user` instead of `/copilot-api/server`.
* When the `access_token` expires, the front-end app can (autonomously from your server) call [Refresh tokens](/2024-04-22/user/jwt-refresh.md) to get a new pair of tokens.