> For the complete documentation index, see [llms.txt](https://api.circle.so/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://api.circle.so/apis/headless/auth-sdk/getting-started.md). # Getting Started ### Overview The Circle Auth SDK provides a secure and efficient way to handle member authentication and token management in your server-side applications. The SDK exposes six main functions, allowing you to obtain, refresh, and revoke member access tokens securely. This SDK was designed to be used on the server to avoid exposing your app token. {% hint style="info" %} Do not run or expose any of these authentication functions in your client-side codebase. {% endhint %} ### Generate your API Token Your `API Token` identifies your community with the Auth API, so your server can generate access tokens for your members. Follow the [Quick start](/apis/headless/quick-start.md) for instructions on how to generate your API Token. > IMPORTANT: The API Token must be of type \`Headless Auth\` for the Auth APIs to work. The token's name doesn't matter. ### Security Best Practices * Keep your `API Token` secure by not exposing it to the client side. This SDK was designed to run on the server side to protect sensitive information. * Securely store members’ `access_token` and `refresh_token` and use them for authenticated requests to our [Headless Member API](https://api-headless.circle.so/?urls.primaryName=Member%20APIs). * Reinforce the authentication process’ security by refreshing the access tokens regularly. * Revoking access\_token and refresh\_token whenever a member logs out or when the tokens are no longer needed can prevent unauthorized access. ### Error Handling Calls to the SDK functions will return a `Success` response with the desired data or an error response if something goes wrong. Ensure errors are handled appropriately by providing the user with meaningful error messages whenever necessary.