# Clerk Authentication Setup

## Issue

The backend server is returning 401 Unauthorized errors because the Clerk Secret Key is not configured correctly.

**Error**: `The provided Clerk Secret Key is invalid. Make sure that your Clerk Secret Key is correct.`

## Solution

You need to add your real Clerk Secret Key to the backend environment configuration.

### Steps to Fix

1. **Get your Clerk Secret Key**:
   - Go to [Clerk Dashboard](https://dashboard.clerk.com)
   - Navigate to **API Keys** section
   - Copy your **Secret Key** (starts with `sk_test_...` for test environment or `sk_live_...` for production)

2. **Update the backend .env file**:
   - Open `server/.env`
   - Replace the placeholder with your real secret key:
   
   ```env
   # Before (placeholder)
   CLERK_SECRET_KEY="sk_test_placeholder"
   
   # After (your real key)
   CLERK_SECRET_KEY="sk_test_YOUR_ACTUAL_SECRET_KEY_HERE"
   ```

3. **Restart the backend server**:
   - The server will automatically restart if you're using `npm run dev`
   - Or manually restart it

### Current Configuration

**Frontend** (`.env.local`):
```env
VITE_CLERK_PUBLISHABLE_KEY=pk_test_YWJvdmUtZmxvdW5kZXItOTEuY2xlcmsuYWNjb3VudHMuZGV2JA
```
✅ This is configured correctly

**Backend** (`server/.env`):
```env
CLERK_SECRET_KEY="sk_test_placeholder"
```
❌ This needs to be updated with your real secret key

### How to Find Your Keys

1. Visit: https://dashboard.clerk.com/last-active?path=api-keys
2. You'll see two keys:
   - **Publishable Key** (pk_test_...) - Already configured in frontend ✅
   - **Secret Key** (sk_test_...) - Needs to be added to backend ❌

### Security Note

⚠️ **Never commit your secret key to version control!**

The `.env` file is already in `.gitignore`, but always double-check before committing.

### Testing After Setup

Once you've added the correct secret key:

1. The server will restart automatically
2. Try uploading a photo in the report form
3. You should see successful uploads instead of 401 errors

### Verification

You can verify the setup is working by checking the server logs:

```
Auth middleware - Authorization header: present
Auth middleware - Token extracted, length: XXX
Auth middleware - Session verified for user: user_XXXXX
```

If you see these logs, authentication is working correctly!