> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sumvin.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth model

> The three credentials Sumvin uses and which one belongs on which call.

# Auth model

Sumvin has three auth primitives. They are not interchangeable — each one fits a specific surface and caller.

## The three primitives

| Credential            | Header                        | Issued by                                                                                                                                                             | Used on                                                     |
| --------------------- | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- |
| **Auth-provider JWT** | `x-juno-jwt`                  | Dynamic, Privy, or <Tooltip headline="SIWE" tip="Sign-In With Ethereum — wallet-based authentication." cta="Glossary →" href="/glossary">SIWE</Tooltip> (your choice) | Platform API — acting on behalf of a signed-in user         |
| **SIS API key**       | `Authorization: Bearer <key>` | Sumvin (partner onboarding)                                                                                                                                           | SIS — calling as a registered partner                       |
| **PINT JWT**          | `x-sumvin-pint-token`         | SIS (on token exchange)                                                                                                                                               | Inbound to verifiers — a user's credential presented to you |

## Decision tree

* I'm calling the Platform API on behalf of a user I authenticated → **auth-provider JWT** in `x-juno-jwt`.
* I'm exchanging a signed PINT, fetching JWKS, or looking up a user by SRI at SIS → **SIS API key**.
* I'm receiving a credential from a user's browser or agent on an inbound request → **PINT JWT** (I verify it; I don't issue it).

## What each credential proves

* The **auth-provider JWT** proves the caller is an authenticated user of your app.
* The **SIS API key** proves the caller is a registered Sumvin partner with known permissions.
* The **PINT JWT** proves a specific user signed a specific authorisation, attested by SIS.

The three don't stack on the same request. An inbound verifier request carries a PINT JWT — the verifier's outbound calls to SIS then carry its own SIS API key.

## See also

* [Platform API authentication](/authentication) — how `x-juno-jwt` works
* [SIS Dashboard authentication model](/dashboard/authentication-model) — how auth providers attach to environments
* [Identity authentication](/identity/authentication) — issuer, audience, key identifiers
* [Verifier headers](/merchant/headers) — every header on an inbound verifier request

## Referenced from

* [Introduction](/introduction)
* [Platform API vs SIS](/concepts/platform-vs-sis)
* [Environments, organisations, and CORS](/concepts/environments-organisations-cors)