---
title: Authentication
description: How partner applications authenticate to the Clerky Partner API.
---

# Authentication

The Clerky Partner API will use OAuth 2.0 bearer tokens. OAuth-based access is
coming soon; client registration, URLs, scopes, token lifetime, and refresh
behavior will be published before partner integrations launch.

## Authorization flow

The Partner API will use the authorization code flow:

1. Redirect the user to Clerky.
2. The user signs in and authorizes access.
3. Clerky redirects back with an authorization code.
4. Your server exchanges the code for an access token.
5. Your server sends the token with Partner API requests.

## Access model

Each token is limited by the authorizing user, authorized Clerky teams, and
granted OAuth scopes. A token can only access resources allowed by all three.

Keep the code exchange and token storage on your server. Do not expose client
secrets or tokens in browser or mobile code.

## API requests

Send the access token as a bearer token. Include `Accept` on every request.

```http
Authorization: Bearer ACCESS_TOKEN
Accept: application/vnd.api+json
```

For requests with a JSON body, also include `Content-Type`.

```http
Content-Type: application/vnd.api+json
```