> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dacard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the Dacard.ai API

# Authentication

Dacard.ai uses [Clerk](https://clerk.com) for authentication. Most API endpoints require a valid session, but some are publicly accessible.

## Authentication methods

<CardGroup cols={2}>
  <Card title="Session cookie" icon="cookie">
    **`__session`** cookie set automatically when a user signs in via the dashboard. Used by the web app and browser-based integrations.
  </Card>

  <Card title="Bearer token" icon="key">
    **`Authorization: Bearer <jwt>`** header for server-to-server and programmatic access. JWTs are issued by Clerk.
  </Card>
</CardGroup>

## Session cookie (browser)

When a user signs in at [app.dacard.ai](https://app.dacard.ai), Clerk sets a secure `__session` cookie. All subsequent requests from the browser include this cookie automatically.

No additional configuration is needed for browser-based access.

## Bearer token (server-to-server)

For programmatic access, include a Clerk-issued JWT in the `Authorization` header:

```bash theme={null}
curl -X GET https://app.dacard.ai/api/products \
  -H "Authorization: Bearer eyJhbGciOiJS..."
```

To obtain a JWT, use the Clerk SDK or the Clerk Frontend API from an authenticated session.

## Public endpoints

The following endpoints do not require authentication:

| Endpoint              | Method | Description                      |
| --------------------- | ------ | -------------------------------- |
| `/api/score/{id}`     | `GET`  | View any scoring result by ID    |
| `/api/try-score`      | `POST` | Anonymous scoring (rate-limited) |
| `/api/og`             | `GET`  | Open Graph image generation      |
| `/api/stripe/webhook` | `POST` | Stripe webhook receiver          |

## Public routes

These pages are accessible without sign-in:

* `/r/{id}`, Shared score result pages
* `/try`, Anonymous scoring page
* `/pricing`, Pricing page
* `/demo/*`, Demo pages
* `/sign-in`, `/sign-up`, Authentication pages

## Error responses

When authentication fails, the API returns a `401 Unauthorized` response:

```json theme={null}
{
  "error": "Authentication required"
}
```

When a user lacks the required role or permission, the API returns a `403 Forbidden` response:

```json theme={null}
{
  "error": "Forbidden: insufficient permissions"
}
```

## Role-based access

After authentication, endpoints enforce role-based access control (RBAC). Each user is assigned a role that determines which actions they can perform. See the [Roles & Permissions](/rbac) guide for the full permission matrix.