# Proxy Tokens | Modal Docs

- **URL:** https://modal.com/docs/guide/webhook-proxy-auth
- **Summary:** Use Proxy Tokens to prevent unauthorized clients from triggering your Web Functions.

Copy page

Proxy Tokens
============

Use Proxy Tokens to prevent unauthorized clients from triggering your Web Functions.

    import modal
    
    image = modal.Image.debian_slim().pip_install("fastapi")
    app = modal.App("proxy-auth-public", image=image)
    
    
    @app.function()
    @modal.fastapi_endpoint()
    def public():
        return "hello world"
    
    
    @app.function()
    @modal.fastapi_endpoint(requires_proxy_auth=True)
    def private():
        return "hello friend"

The `public` endpoint can be hit by any client over the Internet.

    curl https://public-url--goes-here.modal.run

The `private` endpoint cannot.

    curl --fail-with-body https://private-url--goes-here.modal.run
    # modal-http: missing credentials for proxy authorization
    # curl: (22) The requested URL returned error: 401
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401

Authorization is demonstrated via a Proxy Token. You can create a Proxy Token for your Workspace [here](https://modal.com/settings/proxy-auth-tokens)
. In requests to the Web Function, clients supply the Token ID and Token Secret in the `Modal-Key` and `Modal-Secret` HTTP headers.

    export TOKEN_ID=wk-1234abcd
    export TOKEN_SECRET=ws-1234abcd
    curl -H "Modal-Key: $TOKEN_ID" \
         -H "Modal-Secret: $TOKEN_SECRET" \
         https://private-url--goes-here.modal.run

Proxy authorization can be added to [Web Functions](https://modal.com/docs/guide/webhooks)
 created by the [`fastapi_endpoint`](https://modal.com/docs/sdk/py/latest/modal.fastapi_endpoint)
, [`asgi_app`](https://modal.com/docs/sdk/py/latest/modal.asgi_app)
, [`wsgi_app`](https://modal.com/docs/sdk/py/latest/modal.wsgi_app)
, or [`web_server`](https://modal.com/docs/sdk/py/latest/modal.web_server)
 decorators, which are otherwise publicly available.

Everyone within the Workspace of the Web Function can manage its Proxy Tokens.

Restricting tokens to specific Environments 

On Workspaces with RBAC enabled, tokens can be scoped to specific Environments, restricting which Web Functions they are valid for. See [Proxy tokens for Web Functions](https://modal.com/docs/guide/rbac#proxy-tokens-for-web-functions)
 in the RBAC guide for more.

[Proxy Tokens](https://modal.com/docs/guide/webhook-proxy-auth#proxy-tokens)
[Restricting tokens to specific Environments](https://modal.com/docs/guide/webhook-proxy-auth#restricting-tokens-to-specific-environments)

See it in action

[Create a Proxy Token](https://modal.com/settings/proxy-auth-tokens)

[Deploy a proxy authorized endpoint](https://modal.com/docs/examples/basic_web)