# Authentication
source: https://docs.chalk.ai/docs/workload-settings/authentication

## Require a Chalk access token on every request to a scaling group or function.

The authenticated setting applies to scaling groups and
functions. A function takes the same argument,
@chalkcompute.function(authenticated=True), and passes it to the scaling group it runs on.

### Requiring an access token

A scaling group's web_url is public by default: anyone who has the URL can
send requests to it. To require a Chalk access token on every request, set
authenticated=True from the SDK or pass --authenticated from the CLI. A
request without a valid token gets an HTTP 401 response.

```
import chalkcompute

img = chalkcompute.Image.debian_slim("3.12").entrypoint(
    ["python", "-m", "http.server", "8080"]
)

sg = chalkcompute.ScalingGroup(
    image=img,
    name="hello-api",
    port=8080,
    authenticated=True,
    startup_probe=chalkcompute.StartupProbe.http("/"),
).deploy()

resp = sg.call("/", method="GET")
print(resp.status)
```

.call() sends your Chalk access token automatically. Any other client sends
the token as a bearer token in the Authorization header. Get a token with
chalk token get. In this example, WEB_URL holds the group's web_url:

```
$ curl -H "Authorization: Bearer $(chalk token get)" "$WEB_URL/"
```

Access tokens expire. To request a longer lifetime, pass --expires-in, for
example chalk token get --expires-in 24h. The server can cap the lifetime at
the maximum allowed for your credentials.

Private routing, which keeps a group off the public internet, requires setup with
Chalk. To use it, contact Chalk support.