# Member Authentication
> Source: /api-reference/authentication/member-auth
> Clerk-based authentication for member endpoints

# Member Authentication

Members authenticate using Clerk JWT tokens obtained through various sign-in methods.

## Authentication Flow [#authentication-flow]

```mermaid
sequenceDiagram
    participant User
    participant Client
    participant Clerk
    participant API
    
    User->>Client: Sign in request
    Client->>Clerk: OAuth/Email/Phone
    Clerk-->>Client: JWT token
    Client->>API: POST /members/me/auth/validate
    API-->>Client: Member provisioned
    Client->>API: API requests with JWT
```

## Required Headers [#required-headers]

```http
Authorization: Bearer <CLERK_JWT_TOKEN>
Content-Type: application/json
```

## Member Provisioning [#member-provisioning]

<Warning>
  Always call `/members/me/auth/validate` before making member-specific requests.
</Warning>

```typescript
// Step 1: Provision member
const validateResponse = await fetch('/members/me/auth/validate', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${clerkToken}`
  }
});

const { member } = await validateResponse.json();
// member.provisionedNow indicates if new member was created
```

## Development Testing [#development-testing]

For local development, use the test header:

```http
X-Test-Clerk-Id: test_2abc123...
```

## Token Claims [#token-claims]

Clerk JWT tokens include:
- `sub`: User ID
- `email`: Primary email
- `phone_number`: Primary phone
- `exp`: Expiration timestamp
- `iat`: Issued at timestamp

## Bruno Examples [#bruno-examples]

- `bruno/Members (Surface)/Auth/Validate.bru`
- `bruno/Members (Surface)/Me/Profile/Get Me.bru`

## Error Handling [#error-handling]

| Status | Description |
|--------|-------------|
| 401 | Invalid or expired token |
| 403 | Member not provisioned |
| 404 | Member not found |