Overview
There is one HTTP API — the /v1 surface described in the Internal API section — and external integrators reach it the same way the SPA does, except they authenticate with an API key instead of a session. The same requireTenant middleware, the same can() permission gates, the same error envelope, and the same RLS tenant isolation all apply.
API keys
API keys authenticate integrations against the /v1 surface. They are managed under /v1/api-keys (api/src/routes/api-keys.ts) and verified in verifyApiKey (packages/adapters/src/clerk-auth.ts). They are checked against the application database, with no Clerk round-trip.
Webhooks
There are two independent webhook directions: