# User authentication

> How getAuth identifies the signed-in user and forwards their credentials to your API.

Source: https://sideagent.dev/docs/auth

The agent acts as the signed-in user. In `getAuth` you verify the request the way your API does, and return:

```ts
getAuth: async (req) => {
  const user = await verifySession(req); // your code; return null to reject
  if (!user) return null;
  return { userId: user.id, headers: { authorization: req.headers.get("authorization")! } };
}
```

- `userId` scopes chat threads: a user can only see their own history.
- `headers` are forwarded to your API on every tool call, so your API enforces its normal permissions. The agent never has more access than the user.

## Credentials must travel in Authorization

The browser can only send `content-type` and `authorization` to the endpoint, so credentials must travel in `Authorization`. Cookies are not forwarded.