# Authentication for AI agents and integrators

Kadima (heykadima.com) is a productized service storefront. There is no public write API for autonomous account actions. The two authenticated surfaces are:

## Customer dashboard
- URL: https://dashboard.heykadima.com
- Method: passwordless email magic link (one-time sign-in link sent by email). No passwords are used or stored.
- Scope: a signed-in customer can view only their own orders and deliverables (enforced by row-level security).

## Order room (per-order review link)
- URL pattern: https://heykadima.com/portal?t=<signed-token>
- Method: an HMAC-signed, per-order token delivered by email. It grants read plus approve/comment access to that single order only.

## Purchasing
- Checkout is handled by Stripe. See the OpenAPI description at https://heykadima.com/openapi.json for the public checkout endpoint.

Contact: hello@heykadima.com