# Authentication

- Auth is handled by Clerk (`@clerk/react-router`)
- User records are synced from Clerk via webhook at `routes/api/webhooks/clerk.ts`
- Ownership validation: check `ownerId` field against the Clerk user ID (`clerkId`)
- Admin access: `isAdmin` boolean on the users table; all `/admin` routes enforce this
- League commissioners: stored separately in the `commissioners` table (not via `isAdmin`)