# `createClient().auth.admin`

Top-level admin bindings:

```ts
createClient().auth.admin.hasPermission() -> /admin/has-permission
createClient().auth.admin.apiKey.create() -> /admin/api-key/create
createClient().auth.admin.athenaClient.create() -> /admin/athena-client/create
createClient().auth.admin.athenaClient.list() -> /admin/athena-client/list
createClient().auth.admin.oauthClient.create() -> /admin/oauth-client/create
createClient().auth.admin.oauthClient.list() -> /admin/oauth-client/list
createClient().auth.admin.auditLog.list() -> /admin/audit-log/list
```

OAuth client registry purpose:

- social OAuth callback allowlist management for `signIn.social()` and `social.link()`
- not a full OAuth authorization-server client registration surface

## Auth Model

Admin routes currently authenticate with the normal Athena Auth session system and then check the caller's global `user.role`.

- `Authorization: Bearer <session-token>` is accepted
- the configured session cookie is also accepted
- if both are present, bearer wins
- the default required role is `"admin"`

See [Auth runtime behavior](../runtime-behavior.md#admin-api-authentication-model) for the current implementation details.

Nested namespaces:

- [`role`](./role/README.md)
- [`user`](./user/README.md)
- [`email`](./email/README.md)
