401 Unauthorized if no valid credentials are provided.
Authentication Methods
- JWT (Recommended)
- API Key
The primary authentication method uses JSON Web Tokens. The API verifies JWT session tokens issued by the platform’s authentication provider.
Bearer Token
Pass the session token in theAuthorization header:Session Cookie
Browser-based clients can authenticate using the session cookie, which is set automatically during sign-in. No manual header is needed when making requests from the same domain.Public Endpoints
The following endpoints do not require authentication:Role-Based Access Control (RBAC)
After authentication, the API enforces role-based access control. The authenticated user’s role determines which endpoints and actions they can access.Role Hierarchy
Roles are organized in a hierarchy where higher-level roles have more privileges. Some endpoints require a minimum role level.Role Guards
The API enforces role-based access on every request:- Unauthenticated requests receive
401. - Authenticated users whose role is below the minimum required level receive
403.
staff role (level 4+), while webhook management requires admin (level 6+).
Auth Context
Once authenticated, route handlers receive anauth context object with these fields: