Authentication
Dashboard session
Browser users authenticate with Supabase Auth (Google OAuth, magic link, or password). Dashboard API routes read the session cookie via getAuthContext().
Unauthenticated calls receive 401.
Cron & webhooks
| Route | Auth |
|---|---|
POST /api/webhook/stripe |
Stripe signature header |
POST /api/webhooks/apify |
Job id query + Apify payload |
GET /api/cron/refresh |
Authorization: Bearer CRON_SECRET |
GET /api/cron/alerts |
Authorization: Bearer CRON_SECRET |
Agent guidance
AI assistants must never ask users to paste secrets into chat. Prefer environment variables and the dashboard session.