Clerk-managed authentication
Sign-in and one-time codes are handled by Clerk. The API verifies signed tokens before allowing access to private chart and conversation routes.
User-scoped data access
Profile, chart, session, and message queries are tied to the authenticated account rather than trusting an identifier supplied by the browser.
Validated and traceable requests
The API validates request shapes and returns a request ID so production failures can be followed through structured server logs.
Production configuration checks
The service refuses insecure or incomplete production settings at startup instead of silently running with development defaults.