# devRant API: Authentication & accounts Write operations authenticate with the devRant token triple. Log in once below and every authenticated widget across these pages becomes runnable (the token is kept in your browser only). Read operations ([rants](/docs/devrant-rants.html), [profiles](/docs/devrant-users.html)) need no authentication. `POST /api/users/auth-token` returns an `auth_token` whose `id` is the `token_id`, `key` is the `token_key`, and `user_id` is the integer user id; those three are sent automatically by these widgets (query params for `GET`/`DELETE`, form body for `POST`). A bad login returns HTTP `400`. See the [overview](/docs/devrant.html) for the response envelope. A DevRant auth token (the `key` field) also works on the **main DevPlace API**: use it as a Bearer token or `X-API-KEY` header on any DevPlace endpoint. See [Authentication](/docs/authentication.html) for details. DevPlace also has its own native token endpoint at `POST /auth/token` - see the [Authentication](/docs/authentication.html) page.