> For the complete documentation index, see [llms.txt](https://devs.truebit.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://devs.truebit.io/developing-truebit-tasks/task-authorization.md).

# Task Authorization

**This process enables the Namespace Owner to grant or deny permissions to one or more users for executing deployed and registered tasks within the namespace.** This permission determines who can execute the task and who will be responsible for the associated costs.

<figure><img src="/files/YERw5qYMzFEvzi4785Bl" alt=""><figcaption><p>Task Authorization Process</p></figcaption></figure>

### Task Authorization Process

1. **Granting Permission:** The [Namespace owner](/developing-truebit-tasks/namespace-management.md#namespace) grants permission to the [Task Requester](/verifying-truebit-tasks/introduction.md) by calling the [auth grant](/developing-truebit-tasks/truebit-cli-reference.md#auth-grant) command within the Truebit CLI.
2. **Creating an API Key:** The Task Requester creates a new API key by calling the [auth new-apikey](/developing-truebit-tasks/truebit-cli-reference.md#auth-new-apikey) command from the Truebit CLI.
3. **Registering the API Key:** The Task Requester registers the API key by calling the [auth register](/developing-truebit-tasks/truebit-cli-reference.md#auth-register) command from the CLI. The person who registers the API key **will be responsible for paying for the task execution**, regardless of who calls the task.
   * The Task Requester can pass the created API key to someone else to execute the task. However, the one who registered the key will still pay for the execution: Imagine a development team consisting of several developers who need to execute the task. Each developer can have his/her own unique API key or share the same API key.
4. **Executing the Task:** The Task Requester calls the execute endpoint using the API key.
5. **Validating and Executing:** The [Dispatcher](/architecture/introduction/truebit-verify-hub.md#dispatcher) service validates that the API key has permission to execute tasks within the task namespace. If verified, the dispatcher starts the task execution workflow.

{% hint style="success" %}
During the Public Beta, Truebit will cover the cost of the task execution. To qualify, please ensure you’re registered on our platform.
{% endhint %}

### **Truebit CLI Commands**

To interact with the Task Authorization smart contract, we created several commands within the Truebit CLI:

#### [Auth Commands](/developing-truebit-tasks/truebit-cli-reference.md#auth)

* [auth grant](/developing-truebit-tasks/truebit-cli-reference.md#auth-grant)
* [auth revoke](/developing-truebit-tasks/truebit-cli-reference.md#auth-revoke)
* [auth register](/developing-truebit-tasks/truebit-cli-reference.md#auth-register)
* [auth deregister](/developing-truebit-tasks/truebit-cli-reference.md#auth-deregister)
* [auth check-authorization](/developing-truebit-tasks/truebit-cli-reference.md#auth-check-authorization)
* [auth get-payer](/developing-truebit-tasks/truebit-cli-reference.md#auth-get-payer)
* [auth new-apikey](/developing-truebit-tasks/truebit-cli-reference.md#auth-new-apikey)

These commands help manage who can execute the deployed task and who will be responsible for paying for those executions.

### **Accessing a Namespace**

To allow an address to execute tasks stored in a namespace, the namespace owner must grant permission. This can be done by calling the [auth grant](/developing-truebit-tasks/truebit-cli-reference.md#auth-grant) command from the CLI. Only the namespace owner has the authority to grant this permission. If the namespace owner wants to revoke the previously granted permission, they should call the [auth revoke](/developing-truebit-tasks/truebit-cli-reference.md#auth-revoke) command from the CLI.

### API\_KEYS

Any user with granted permission to a namespace can generate their own API\_KEYS using the [auth new-apikey](/developing-truebit-tasks/truebit-cli-reference.md#auth-new-apikey) command from the CLI. The user who generates the API\_KEY must register it by calling the [auth register](/developing-truebit-tasks/truebit-cli-reference.md#auth-register) command. The user who registers the API\_KEY becomes the payer for any task execution made using that API\_KEY.&#x20;

The API\_KEY allows others to execute tasks stored in the namespace while ensuring that the API\_KEY registrant pays for the execution.&#x20;

If the registrant wants to deregister the API\_KEY so that no one else with the API key can execute tasks, they should call the [auth deregister](/developing-truebit-tasks/truebit-cli-reference.md#auth-deregister) command from the CLI.

{% hint style="info" %}
To use the API KEY to execute a task, please look at the [Task Execution](/integrating-truebit-tasks/introduction.md) endpoint.
{% endhint %}