# Authentication Overview
> Source: /api-reference/authentication/overview
> Authentication methods for Journey API

# Authentication

Journey API uses different authentication methods based on the surface.

## Authentication Methods [#authentication-methods]

| Surface | Method | Provider | Token Type |
|---------|--------|----------|------------|
| Members | OAuth/JWT | Clerk | Bearer token |
| Admin | SSO/JWT | WorkOS | Bearer token |
| Partner operator | SSO/JWT | WorkOS | Bearer token with selected organization, permissions, and resource roles |
| Partner integration | API key | Journey | Bearer API key with partner/service auth level and grants |
| Internal service | Service credential | Journey | Server-only bearer credential with permissions and organization grants |
| Public | None | - | No auth required |

<Note>
  HXP Threads and Actions use a separate authentication boundary: WorkOS-backed
  HXP sessions for operator HTTP routes, and resource-specific delegated OAuth
  for qualified MCP hosts when activated. Journey API keys do not authenticate
  those routes. See [HXP authentication](/hxp/authentication).
</Note>

## Quick Start [#quick-start]

<Tabs>
  <Tab title="Members API">
    ```typescript
    const response = await fetch('/members/me', {
      headers: {
        'Authorization': `Bearer ${clerkToken}`
      }
    });
    ```
  </Tab>
  <Tab title="Admin API">
    ```typescript
    const response = await fetch('/admin/members/query', {
      headers: {
        'Authorization': `Bearer ${workosToken}`
      }
    });
    ```
  </Tab>
  <Tab title="Partner operator">
    ```typescript
    const response = await fetch('/partner/insights/guests?limit=50', {
      headers: {
        'Authorization': `Bearer ${workosToken}`
      }
    });
    ```
  </Tab>
  <Tab title="Internal service">
    ```typescript
    const response = await fetch(
      `/internal/organizations/${organizationExternalId}/billing/workspace`,
      {
        headers: {
          'Authorization': `Bearer ${serviceCredential}`
        }
      }
    );
    ```
  </Tab>
  <Tab title="Public API">
    ```typescript
    // No authentication required
    const response = await fetch('/public/properties/PROP123');
    ```
  </Tab>
</Tabs>

## Token Validation [#token-validation]

JWT tokens are validated for:

- Signature verification
- Expiration time
- Issuer validation
- Audience validation

Protected Core routes additionally validate permission and organization scope.
Partner operator routes resolve WorkOS `org-brand:<internal-id>` and
`org-property:<internal-id>` roles into a concrete property allowlist. Internal
service credentials are never exposed to a browser.

## Error Responses [#error-responses]

```json
{
  "statusCode": 401,
  "message": "Unauthorized",
  "error": "Invalid or expired token"
}
```

## Next Steps [#next-steps]

- [Member Authentication](/api-reference/authentication/member-auth)
- [Admin Authentication](/api-reference/authentication/admin-auth)
- [API Keys](/api-reference/authentication/api-keys)
- Core authentication and scoped access