# Authentication

Learn how Annot8 dashboard sign-in, origin-validated widget sessions, and public feedback links authenticate team members and guest reviewers.

Source: https://docs.annot8.app/docs/authentication



Annot8 uses [Clerk](https://clerk.com) for dashboard identity, and a separate
short-lived, origin-validated session for the widget running on your site.

## Signing in to the dashboard [#signing-in-to-the-dashboard]

Three ways in:

* **Email code** — enter your address and Annot8 emails you a one-time code.
  There is no password to set, forget, or leak.
* **Google**
* **GitHub**

All three land on the same account, so you can start with a code and later use
Google without creating a duplicate.

<Callout type="info">
  Annot8 does not use passwords for dashboard sign-in. If a page or email asks
  you for an Annot8 password, it did not come from us — forward it to
  [security@annot8.app](mailto:security@annot8.app).
</Callout>

## How the widget authenticates [#how-the-widget-authenticates]

The widget UI runs in a sandboxed iframe served from the Annot8 origin, which
means it can't read your page's cookies and your page can't read its session.

### Team members [#team-members]

If you're already signed in to the dashboard in that browser, the widget picks
up your session and your comments are attributed to your account. If not, the
widget opens a sign-in popup; once you finish, the widget picks up straight
where you were.

Popup blockers are the usual reason this appears to hang — the popup is opened
in response to your click, so allowing popups for your own site resolves it.

### Guests [#guests]

Anyone can leave feedback without an account through a public link. They give a
name (and optionally an email) with their first comment, and the thread is
attributed to that name.

Guest reviewers never consume a paid seat. The Free plan allows 3 distinct guest
reviewers per workspace; every paid plan makes them unlimited.

### Origin validation [#origin-validation]

Before any public write is accepted, the widget calls Annot8 with your project
key. Annot8 checks the browser-sent `Origin` header against the project's
environment patterns and, if it matches, issues a short-lived session token.
Writes without a valid token are rejected.

This is why a stolen script tag doesn't work on someone else's domain: the
project key alone isn't enough, the request has to arrive from a hostname you
authorised.

## Roles [#roles]

Roles are set per workspace. See [Team members](/docs/dashboard/team-members)
for the full permission matrix.

|                                 | Owner | Admin | Member    |
| ------------------------------- | ----- | ----- | --------- |
| View projects and threads       | Yes   | Yes   | Yes       |
| Comment, resolve threads        | Yes   | Yes   | Yes       |
| Create / edit / delete projects | Yes   | Yes   | No        |
| Manage integrations             | Yes   | Yes   | View only |
| Invite and remove members       | Yes   | Yes   | No        |
| Change someone's role           | Yes   | No    | No        |
| Manage billing                  | Yes   | Yes   | No        |
| Delete the workspace            | Yes   | No    | No        |

Guests who comment through a public link have no dashboard access at all.

## SAML / OIDC SSO [#saml--oidc-sso]

Single sign-on is part of the **Business** and **Enterprise** plans. It isn't
self-serve — we configure it with your identity provider during onboarding.
Email [sales@annot8.app](mailto:sales@annot8.app) to start.

## There is no public customer-data REST API yet [#there-is-no-public-customer-data-rest-api-yet]

Annot8 publishes a read-only discovery description at
[annot8.app/openapi.json](https://www.annot8.app/openapi.json), but it does not
expose workspace or customer data through a public REST API or issue API keys.
The `pj_...` project key is a public identifier for the widget rather than a
secret credential. To move data out of Annot8 today, use:

* [Outbound webhooks](/docs/integrations/webhooks) — a JSON POST on every new
  thread, which is what you want for Zapier, Make, or n8n
* **Export CSV** from the project inbox
* **Download your data** in **Account & privacy** for a personal export

## Trouble signing in [#trouble-signing-in]

* **The code email never arrives.** Check spam, then confirm you typed the same
  address you signed up with. Codes are single-use and short-lived — request a
  fresh one rather than reusing an old email.
* **The widget's sign-in popup does nothing.** Allow popups for your site.
* **You're signed in but see no projects.** You're probably in the wrong
  workspace. Switch it from the selector at the top of the sidebar.