Authentication

API keys and OAuth 2.0, shared across every product.

Nasah Group LTD uses one login (Supabase Auth) shared across every app in the ecosystem. There's no separate API-key system yet.

Public endpoints

/v1/products and /v1/posts need no auth — the same data your website already shows visitors.

User-specific endpoints

Endpoints like /v1/me expect the caller's own access token:

Authorization: Bearer <access_token>

Because every app points at the same Supabase project, a token from any one of them is valid on the API too.

Coming later

API keys for third-party developers aren't built yet — this page will be updated when that ships.