# Accounts & Authentication

> Sign in with Firebase, verify your email and use the correct credentials for marketplace sessions and model APIs.

Canonical: https://theaimart.co/docs/accounts-and-auth
Updated: 2026-10-08 · Guide version: 1.1

The marketplace dashboard uses a verified account session. Model API keys are a different credential; they do not authorize marketplace publishing requests.

## Sign in and verify your email

1. Open [Sign in](/login) and select email sign-in or the available Google sign-in option.
2. For an email account, create the account, then open the verification email. Creating the Firebase account does not immediately create a verified marketplace session.
3. Sign in again after verification. The frontend exchanges the Firebase ID token for a backend session.
4. Open [the dashboard](/Dashboard). Submit listings from the appropriate publishing form.

An unverified email account is signed out and shown instructions to verify. A verification resend can be rate limited; the earlier link may still work.

## Credentials and permissions

| Credential | Purpose |
| --- | --- |
| Firebase ID token | Exchange at `POST /auth/firebase` with `id_token` |
| Backend session JWT | Authenticated marketplace and dashboard requests |
| AI model API key | Model inference on the documented AIx service |

For an authorized integration, the read-only session check is:

```bash
curl --fail-with-body https://api.theaimart.co/api/v1/auth/me \
  -H "Authorization: Bearer $THEAIMART_SESSION_TOKEN"
```

Keep session tokens and API keys out of public code, screenshots and logs. Dashboard ownership checks apply to listings, releases and other account resources. A workspace membership does not automatically grant ownership of someone else's app.

## Limitations and troubleshooting

There is no automatic marketplace session-refresh endpoint in this client. An expired or invalid session requires sign-in again. A model API key cannot replace the session token in the example above. If sign-in fails, check email verification and the displayed error before retrying. If verification mail does not arrive, check spam and contact support without sending your password or token.

## Next

Read [Getting Started](/docs/getting-started), [API Keys](/docs/api-keys) and [Workspaces](/docs/workspaces).