Authentication

YusofaChain relies exclusively on Clerk-issued JWTs linked to approved workspace accounts.

Overview

The current web application authenticates API requests by sending a Clerk-issued bearer JWT in the Authorization header. There is currently no general public API access program, and we do not issue long-lived static API keys.

Authorization: Bearer <YOUR_CLERK_SESSION_TOKEN>

Workspace-Scoped Access

Tokens are dynamically issued by the Clerk authentication provider. Access is strictly workspace-scoped and subject to explicit administrator approval.

Even with a valid Clerk JWT, API requests receive a 403 Forbidden response if the user account is pending approval or suspended. The server evaluates clearance status dynamically on every request.