---
title: Authentication
slug: web-experimentation/docs/authentication
docTags: 
createdAt: 2026-07-23T11:40:26.461Z
---

Using the access token provided in the authorization response, your application can now access the REST API on behalf of the authorizing user. You can use the REST API as outlined in this documentation, except you should use a header in the format `Authorization: Bearer [token]` instead of `Token: [token]`, as shown in the following example.

Your application should check for 403 errors in case the user has revoked application access, or the token has expired. To resume access, you must prompt users to repeat the authorization flow.

## Example request

```bash
curl \
  -H "Authorization: Bearer abcdefghijklmnopqrstuvwxyz" \
  -X GET "https://api.optimizely.com/experiment/v1/projects/1234/"
```