> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clausum.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Partner keys, webhook ingest keys, and dashboard session JWT

Clausum uses **Bearer authentication**:

```bash theme={null}
Authorization: Bearer <your_key_or_token>
```

<Note>
  Partner API requests use your stage hostname — sandbox `https://sandbox.clausum.ai`, production `https://dashboard.clausum.ai`, or a dedicated host from your account team. See [Access & environments](/concepts/access-and-environments).
</Note>

## Three key types

Create keys in **Dashboard → Conexiones → Claves API** (ingest keys on **Entrada (webhooks)** tab).

| You need…           | Dashboard label    | Prefix     | Typical use                      |
| ------------------- | ------------------ | ---------- | -------------------------------- |
| Browser checkout    | **Publishable**    | `clm_pub_` | SDK, client-side assess          |
| Backend integration | **Secret**         | `clm_sk_`  | Assess, report fraud, payout     |
| Pipe events in      | **Webhook ingest** | `clm_wh_`  | `POST /api/webhooks/ingest` only |

<CardGroup cols={3}>
  <Card title="Publishable" icon="globe">
    `clm_pub_*` — assess only. Safe in the browser.
  </Card>

  <Card title="Secret" icon="server">
    `clm_sk_*` — server only. Never ship to clients.
  </Card>

  <Card title="Ingest" icon="inbox">
    `clm_wh_*` — ingest endpoint only.
  </Card>
</CardGroup>

<Warning>
  Keys are shown **once** at creation. Revocation in Conexiones is immediate.
</Warning>

## Using a key

<CodeGroup>
  ```bash cURL theme={null}
  curl "https://dashboard.clausum.ai/api/v1/assess" \
    -H "Authorization: Bearer clm_sk_xxx" \
    -H "Content-Type: application/json" \
    -d '{ "amount": 10.00, "amount_unit": "major", "currency": "USD" }'
  ```

  ```ts Node.js theme={null}
  const res = await fetch(`${process.env.CLAUSUM_API_BASE}/api/v1/assess`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.CLAUSUM_SECRET_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ amount: 10.0, amount_unit: "major", currency: "USD" }),
  })
  ```
</CodeGroup>

<Tip>
  Use the `Authorization` header — `api_key` query parameters are disabled in production.
</Tip>

## Permissions (secret keys)

| Endpoint                      | Key type              | Permission       |
| ----------------------------- | --------------------- | ---------------- |
| `POST /api/v1/assess`         | Publishable or secret | `assess`         |
| `POST /api/v1/assess/payout`  | Secret only           | `assess`         |
| `POST /api/v1/report-fraud`   | Secret only           | `fraud:report`   |
| `POST /api/webhooks/ingest`   | Ingest (`clm_wh_`)    | valid ingest key |
| `GET/POST /api/v1/merchant/*` | Secret                | per-key scopes   |

## Dashboard session (not API keys)

Management routes (`blocklists`, `cases`, `submerchants`, …) use a **Supabase JWT** after sign-in — not partner keys.

## Errors

| Status | Meaning                                    |
| ------ | ------------------------------------------ |
| `401`  | Missing, invalid, disabled, or revoked key |
| `403`  | Wrong key type or missing permission       |
| `429`  | Rate limit exceeded                        |

See [Errors](/reference/errors) and [API keys](/guides/api-keys).