API authentication

The API uses protected tRPC procedures for most product operations.

The request context resolves the authenticated user and then applies organization/client authorization before invoking domain services.

Production authentication is configured through Clerk.

Authorization

Domain routes can require an action such as:

• cases.read
• org.manage_integrations
• intelligence.view
• intelligence.calculate

High-impact workflows may also require approved-action and human-review controls.

No generic bearer-token claim

Do not infer endpoint-level access from the presence of a login session. Each protected procedure still performs its intended authorization checks.