# Access Token Controller REST API Reference

FlexNet Operations users call the **access-token-controller** REST web service to request an access token with a limited expiration from FlexNet Operations. The web service returns an access token which is a hexadecimal string with an **rna_** prefix.

When firing requests to a FlexNet Operations API (REST or SOAP), this token must be added to the authentication header of the API request with the word Bearer followed by the token string.

The access token not only authenticates the requester but also defines the permissions of how the requester can use the API.

Access tokens can also be managed using the Producer Portal. For more information, see the topic [Managing Access Tokens](https://docs.revenera.com/fno_CURRENT/producer/Content/helplibrary/platUserMgeAccessTokens.htm) in the [FlexNet Operations User Guide](https://docs.revenera.com/fno_CURRENT/producer/Default.htm) on the [Revenera Documentation](https://docs.revenera.com/) site.