# Finding Bearer Tokens

## Current Status:
✅ Cookies are being captured successfully  
❌ API does NOT accept cookies (401 Unauthorized)  
❓ Need to find where Bearer tokens come from

## The Problem:
Filevine's web app (`product.filevineapp.com`) uses ASP.NET cookies for authentication, but the API (`api.filevineapp.com`) needs Bearer tokens. We need to find where these Bearer tokens come from.

## Possible Sources:

### 1. Token Endpoint
Filevine might have a token endpoint that accepts cookies and returns Bearer tokens:
- `/api/token`
- `/api/auth/token`
- `/connect/token`
- `/identity.filevine.com/connect/token`

### 2. Network Interception
Bearer tokens might be:
- Sent in Authorization headers (we're already intercepting these)
- Returned in API responses
- Stored somewhere we haven't checked yet

### 3. Check Network Tab
Please check the Network tab for:
1. **Any requests to `/api/token` or `/connect/token`**
2. **Any responses that contain `access_token`**
3. **Any requests with `Authorization: Bearer ...` headers**

## What to Check:

1. **Open DevTools → Network tab**
2. **Filter by "token" or "auth"**
3. **Look for:**
   - Requests to token endpoints
   - Responses with `access_token` in the body
   - Any requests with `Authorization: Bearer ...` headers

4. **Check if Filevine's frontend makes API calls:**
   - Does `/api/orgs` return a token?
   - Does `/api/currentuser` return a token?
   - Is there a token in any response?

## Next Steps:

Once we find where Bearer tokens come from, we can:
1. Intercept them from network requests
2. Or call the token endpoint with cookies
3. Or extract them from API responses

Please check the Network tab and share what you find!
