> ## Documentation Index
> Fetch the complete documentation index at: https://docs.drpn.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth and access

> How sessions, active company and active tenant scope, and protected backend calls work.

Darpan access is session-based; users sign in, receive a session, and operate within the active company or active tenant available to them.

## User context

Some users may belong to more than one company or tenant. When that is enabled, the active company or active tenant controls which scoped records they read and write.

## Permission context

Permissions are evaluated for the active company or active tenant. A user can have different capabilities in different companies or tenants.

## Product roles

| Role         | Typical scope                                                                                                    |
| ------------ | ---------------------------------------------------------------------------------------------------------------- |
| Super Admin  | Manages Darpan platform settings, users, tenants, permission assignments, and tenant data.                       |
| Tenant Admin | Manages tenant-owned settings, connections, schemas, saved runs, automations, and results for the active tenant. |
| Tenant User  | Views tenant data, uploads files, runs reconciliation, and reviews output without changing tenant setup records. |

Tenant Admins should confirm the active tenant before saving settings, connection records, schemas, saved runs, or automations.

## Sensitive auth values

Examples use placeholders for usernames, passwords, session cookies, login keys, CSRF tokens, and sensitive auth artifacts.

## API calls

Backend JSON-RPC calls usually require:

* For the browser app: an authenticated session cookie and a valid `X-CSRF-Token`
* For integration callers: a `login_key` header instead of the cookie and CSRF token
* Permission for the target service

***

For backend API authentication details, see [JSON-RPC reference](/api-reference/json-rpc).