Authentication & Authorization
How identity is established and access is checked.
Authentication establishes who is calling; authorization establishes what they may touch.
Authentication
The server extracts the Privy access token (Bearer header or privy-token cookie), verifies it with Privy, and loads the matching User and Merchant. Missing or invalid tokens return 401.
Authorization
Routes that operate on an invoice or merchant assert that the authenticated merchant owns the resource. Requests for another merchant's data return 403.