# Admin Authentication
> Source: /api-reference/authentication/admin-auth
> WorkOS SSO authentication for administrators

# Admin Authentication

Administrators authenticate using WorkOS SSO with role-based permissions.

## Authentication Flow [#authentication-flow]

```mermaid
sequenceDiagram
    participant Admin
    participant Browser
    participant WorkOS
    participant API
    
    Admin->>Browser: Login request
    Browser->>WorkOS: SSO redirect
    WorkOS-->>Browser: Auth code
    Browser->>API: POST /admin/auth/workos/callback
    API-->>Browser: JWT token
    Browser->>API: API requests with JWT
```

## Required Headers [#required-headers]

```http
Authorization: Bearer <WORKOS_JWT_TOKEN>
Content-Type: application/json
```

## Token Exchange [#token-exchange]

```typescript
// Exchange WorkOS auth code for JWT
const response = await fetch('/admin/auth/workos/callback', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    code: authCode,
    redirectUri: 'https://admin.journey.com/callback'
  })
});

const { token, user, permissions } = await response.json();
```

## Permissions [#permissions]

| Permission | Description |
|------------|-------------|
| `members:read` | View member data |
| `members:write` | Edit member data |
| `members:gift` | Gift points/tiers |
| `members:merge` | Merge member accounts |
| `reservations:read` | View reservations |
| `reservations:write` | Modify reservations |
| `analytics:read` | Access analytics |
| `security:admin` | Security settings |

## Permission Checking [#permission-checking]

```typescript
// API checks permissions automatically
// Returns 403 if insufficient permissions

const giftPoints = await fetch(
  '/admin/members/01J5XYZ.../gift',
  {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${token}` // Must have members:gift
    },
    body: JSON.stringify({ points: 1000 })
  }
);
```

## Token Claims [#token-claims]

WorkOS JWT tokens include:
- `sub`: User ID
- `email`: Admin email
- `org_id`: Organization ID
- `permissions`: Array of permissions
- `exp`: Expiration timestamp

## Bruno Examples [#bruno-examples]

- `bruno/Admin/Auth/WorkOS Callback.bru`
- `bruno/Admin/Members/Query.bru`

## Error Handling [#error-handling]

| Status | Description |
|--------|-------------|
| 401 | Invalid or expired token |
| 403 | Insufficient permissions |
| 404 | Resource not found |