Know Who Is Using Your Agent (Auth and Sessions)

# FastAPI + Clerk (or any provider with a Python SDK)
from fastapi import FastAPI, Depends, HTTPException, Request
from clerk_backend_api import Clerk

app = FastAPI()
clerk = Clerk(bearer_auth=os.environ["CLERK_SECRET"])

async def get_current_user(request: Request) -> dict:
    token = request.headers.get("Authorization", "").replace("Bearer ", "")
    try:
        session = clerk.sessions.verify_session(token=token)
        user = clerk.users.get_user(user_id=session.user_id)
        return {"id": user.id, "email": user.email_addresses[0].email_address, "tier": user.public_metadata.get("tier", "free")}
    except Exception:
        raise HTTPException(401)

@app.post("/api/chat")
async def chat(request: Request, user = Depends(get_current_user)):
    # tier-gated features
    if user["tier"] == "free" and not allow(user["id"], 50, 86400):
        raise HTTPException(429, "free tier daily limit")
    # ...

# Database
CREATE TABLE users (
  id           text PRIMARY KEY,         -- match provider's user_id
  email        text UNIQUE NOT NULL,
  tier         text NOT NULL DEFAULT 'free',
  created_at   timestamptz NOT NULL DEFAULT now()
);

CREATE TABLE traces (
  id           bigserial PRIMARY KEY,
  user_id      text NOT NULL REFERENCES users(id),
  ...
);
CREATE INDEX traces_user ON traces(user_id);

-- enable RLS for defense in depth
ALTER TABLE traces ENABLE ROW LEVEL SECURITY;
CREATE POLICY traces_owner ON traces FOR ALL USING (user_id = current_setting('app.uid'));