> ## Documentation Index
> Fetch the complete documentation index at: https://docs.exterview.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment Authentication

> Authentication concepts, environments, and access patterns for deploying Exterview, including API keys, SSO, and session-level access for reviewers.

## Purpose

How people and systems securely access Exterview, and how test and production stay separated.

## Access model

<CardGroup cols={2}>
  <Card title="User login" icon="right-to-bracket">
    Your team signs in using your company's existing Microsoft account, so there's no separate password to manage.
  </Card>

  <Card title="API authentication" icon="key">
    System-to-system access is a documented requirement, not a shipped capability
    yet, see Authentication & Scopes for what's required before it publishes.
  </Card>

  <Card title="Role-based access" icon="user-gear">
    Permissions are scoped by role, configure, run, and review are separate.
  </Card>

  <Card title="Environment separation" icon="layer-group">
    Test and production are isolated from each other.
  </Card>
</CardGroup>

## Environments

| Environment        | Use it for                                          |
| ------------------ | --------------------------------------------------- |
| **Sandbox / test** | Trying workflows, invites, and integrations safely. |
| **Production**     | Live candidate evaluations.                         |

<Warning>
  Always validate in **sandbox** first. Production workflows should only be
  enabled after go-live readiness is confirmed.
</Warning>

## FAQs

<AccordionGroup>
  <Accordion title="How do developers authenticate to the API?">
    Not yet. Automated, system-level API sign-in is a documented requirement, not a shipped capability. See Authentication & Scopes for what's required before it publishes.
  </Accordion>

  <Accordion title="Can we test without affecting live data?">
    Yes. Sandbox is fully isolated from production.
  </Accordion>

  <Accordion title="Who controls access?">
    Your administrators, through role-based access configured in Governance.
  </Accordion>
</AccordionGroup>

## Related

<CardGroup cols={2}>
  <Card title="API Authentication" icon="key" href="/get-started/authentication">
    The requirements that must land before API-key/OAuth access publishes.
  </Card>

  <Card title="Governance" icon="shield-halved" href="/configure/governance">
    Configure users, roles, and access.
  </Card>
</CardGroup>