> ## Documentation Index
> Fetch the complete documentation index at: https://docs.talview.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> The Proview auth module, credential strategies, and which one each module uses

Authentication is handled by the **auth module**. Unlike `session()`, `playback()`, `form()`, and `scheduler()`, it loads automatically — you do not declare it in the `modules` array.

Its strategies live on the `Proview.auth` namespace and are passed as `credential` on `Proview.init()`:

```js theme={null}
await Proview.init({
  dsn: 'YOUR_PROJECT_DSN',
  credential: Proview.auth.TokenAuthStrategy({ token: 'session-token' }),
  modules: [
    Proview.playback(),
  ],
});
```

The credential is declared once and inherited by every module in the `modules` array.

## Strategies

| Strategy                                       | Use it for                                                                                                        |
| ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| `Proview.auth.DefaultAuthStrategy()`           | The implicit default. Applied when `credential` is omitted.                                                       |
| `Proview.auth.TokenAuthStrategy({ token })`    | Passing a token your backend obtained from Talview. Required by [playback](/sdk/session/playback#authentication). |
| `Proview.auth.FirebaseAuthStrategy({ token })` | Integrations that already authenticate users through Firebase.                                                    |

### `DefaultAuthStrategy`

If you do not pass `credential`, the SDK falls back to `DefaultAuthStrategy`. These two are equivalent:

```js theme={null}
await Proview.init({ dsn, modules: [Proview.session()] });

await Proview.init({
  dsn,
  credential: Proview.auth.DefaultAuthStrategy(),
  modules: [Proview.session()],
});
```

Declare it explicitly when you want the choice to be visible in your code rather than implied by an omission.

### `TokenAuthStrategy`

Takes a token your backend obtained from the Talview token endpoint:

```js theme={null}
credential: Proview.auth.TokenAuthStrategy({ token: 'session-token' })
```

Use it whenever the SDK needs to act on behalf of a specific user whose identity only your application can vouch for. Playback is the clearest case — see [Playback → Authentication](/sdk/session/playback#authentication) for why.

<Note>
  **Where the token comes from.** Talview provides the token API as part of your integration — the endpoint and the request format. Contact Talview if you have not received these details.
</Note>

### `FirebaseAuthStrategy`

For applications already using Firebase Authentication:

```js theme={null}
credential: Proview.auth.FirebaseAuthStrategy({ token: 'your-token' })
```

## Choosing a strategy

| Module                  | Strategy                                                                                                                           |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| `playback()`            | `TokenAuthStrategy`                                                                                                                |
| `form()`, `scheduler()` | `FirebaseAuthStrategy`, or `DefaultAuthStrategy` if you are not using Firebase                                                     |
| `session()`             | `DefaultAuthStrategy` — proctoring identifies the attempt through the `dsn` and the identifiers passed to `Proview.session.init()` |

## Handling tokens safely

* **Request the token from your backend, not the browser.** Your server calls the Talview token endpoint and passes the result to the page, so the endpoint's own credential never reaches the browser.
* **Do your own authorization check first.** Talview issues the token; deciding whether this user should have it is your application's job.
* **Treat it like a session credential.** Keep it out of URLs, logs, and analytics payloads. Never ship a shared long-lived token to the browser.

## Troubleshooting

A rejected or insufficient credential surfaces through the global error handler as `AUTH_ERROR` or `UNAUTHORIZED`. See the [Error Reference](/sdk/errors) for the full list, and [Troubleshooting → Authentication failures](/sdk/troubleshooting#authentication-failures) for diagnosis.