# Authentication

| Who calls | Flow | Where the credentials come from |
|---|---|---|
| A person, from this portal or an application | Authorization code with PKCE | Their SmaCH account |

The token names the organizations of the caller and its role in each (`viewer` or
`administrator`). It is valid for a few minutes; an application renews it with the refresh
token it received alongside.