## Session Tokens

The DEVS-Fire API uses **session-based tokens** rather than API keys. Before making any API calls, you must call `/connectToServer` to receive a `userToken` that identifies your simulation session.

```bash
POST https://firesim.cs.gsu.edu/api/connectToServer
```

**Response:**

```json
"abc123xyz"
```

Pass this token as the `userToken` query parameter on every subsequent request.

### Response field

| Field | Type | Required | Description |
|---|---|---|---|
| `userToken` | string | no | Opaque string that identifies your simulation session. Required on all subsequent calls. |

## Usage

```bash
# Get a token
curl -X POST "https://firesim.cs.gsu.edu/api/connectToServer"

# Use the token on all subsequent calls
curl -X POST "https://firesim.cs.gsu.edu/api/setPointIgnition/?userToken=abc123xyz&xs=100&ys=100"
```

## Token scope

Each token is tied to a single simulation instance:

- All configuration, ignition, and query calls are scoped to the token's simulation
- Multiple tokens can exist simultaneously (parallel simulations)
- Each new simulation requires a fresh token from `/connectToServer`
  Tokens are not persistent. If your session ends or is lost, you must start a new simulation with a new token.

See [Debugging API calls](/debugging) for status codes, common 500 errors, and how to refresh response samples in the docs.

## No API key required

The DEVS-Fire API does not require an API key for access. Any client can call `/connectToServer` to start a session.