Authentication
All protected API routes require a Bearer token in the Authorization header:
Authorization: Bearer <accessToken>Current token model
The production app uses Clerk for user identity and API requests carry an app-issued JWT-compatible bearer token. This is the session credential used by the dashboard and first-party clients.
For server-to-server integrations, use a personal API key instead: see The Vitae API. A key authenticates as the user who minted it and works on the same routes the app uses.
curl https://api.vitae.ai/v1/auth/verify \
-H "Authorization: Bearer <accessToken>"Successful response:
{
"status": "OK"
}Account actions
Authenticated users can manage their account email:
| Endpoint | Method | Description |
|---|---|---|
/v1/auth/verify | GET | Verify the bearer token |
/v1/auth/logout | DELETE | Clear the current token |
/v1/auth/change-email | POST | Request an email change |
/v1/auth/change-email/confirm | POST | Confirm an email change |
/v1/auth/change-email/resend | POST | Resend the confirmation code |
Clerk
The app also supports Clerk-backed sessions. Clerk webhooks keep Vitae.ai user records synchronized.
Enterprise SSO
Enterprise SSO is configured per organization. Contact your account team for tenant setup.
API keys
Personal API keys work on all API routes, presented as Authorization: Bearer vit_<prefix>_<secret> (the X-API-Key header is also supported). A key belongs to the user who minted it and authenticates as that user: same role, same permissions, same organization, same response shapes as a session. Keys optionally carry scopes that cap them to specific resources, and each key has its own rate limit. Keys are always refused on /api-keys, /mcp-access-tokens, /oauth, /auth, /users, and /admin routes; key management requires a signed-in session. See The Vitae API for the full key model and Outbound Webhooks for event subscriptions.
Security
- Always use HTTPS
- Never expose organization tokens in client-side code
- Scope tokens to the minimum organization and role required
- Rotate tokens when team members or vendors lose access