Authentication
Authentication Overview
Authentication methods for Journey API
Journey API uses different authentication methods based on the surface.
Authentication Methods
| Surface | Method | Provider | Token Type |
|---|---|---|---|
| Members | OAuth/JWT | Clerk | Bearer token |
| Admin | SSO/JWT | WorkOS | Bearer token |
| Partner operator | SSO/JWT | WorkOS | Bearer token with selected organization, permissions, and resource roles |
| Partner integration | API key | Journey | Bearer API key with partner/service auth level and grants |
| Internal service | Service credential | Journey | Server-only bearer credential with permissions and organization grants |
| Public | None | - | No auth required |
HXP Threads and Actions use a separate authentication boundary: WorkOS-backed HXP sessions for operator HTTP routes, and resource-specific delegated OAuth for qualified MCP hosts when activated. Journey API keys do not authenticate those routes. See HXP authentication.
Quick Start
const response = await fetch('/members/me', {
headers: {
'Authorization': `Bearer ${clerkToken}`
}
});Token Validation
JWT tokens are validated for:
- Signature verification
- Expiration time
- Issuer validation
- Audience validation
Protected Core routes additionally validate permission and organization scope.
Partner operator routes resolve WorkOS org-brand:<internal-id> and
org-property:<internal-id> roles into a concrete property allowlist. Internal
service credentials are never exposed to a browser.
Error Responses
{
"statusCode": 401,
"message": "Unauthorized",
"error": "Invalid or expired token"
}Next Steps
- Member Authentication
- Admin Authentication
- API Keys
- Core authentication and scoped access