Authentication

View full details →

JWT Tokens & API Keys

Two auth methods supported via Bearer token: JWT for interactive users, API keys for programmatic access with fine-grained scopes.

Authorization: Bearer <jwt_token_or_api_key>

Endpoint Groups

Authentication

Two authentication methods, both sent as a Bearer token in the Authorization header.

Authorization: Bearer <jwt_token_or_api_key>

JWT Tokens

For interactive users (web/desktop). Issued by Supabase after sign-in. Access is determined by the user's organisation role.

API Keys

For programmatic/service access. Created via the API with fine-grained scope restrictions.

Format

edd_live_<40 hex characters>

Example: edd_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8

The full key is only returned once at creation time. Only a hashed version is stored.

Creating an API Key

curl -X POST https://api.eddytor.com/api/v1/api-keys/ \ -H "Authorization: Bearer <jwt_token>" \ -H "Content-Type: application/json" \ -d '{ "name": "My Integration", "scopes": ["tables:query", "rows:insert"], "expires_in": "90d" }'

Expiration options: 7d, 30d, 90d, 1y, or never.

Using an API Key

curl https://api.eddytor.com/api/v1/tables/ \ -H "Authorization: Bearer edd_live_a1b2c3d4..."

Management Endpoints

Method Endpoint Description

Scopes

API keys are restricted to an explicit set of scopes. You can use presets or granular scopes.

Presets

Granular Scopes

Category Scopes

An API key can only be granted scopes that the creating user's role permits. AI scopes require a Full or Premium seat.

Permission Model

Security

Rate Limiting

Default
Auth endpoints

When exceeded, a 429 Too Many Requests response is returned with a Retry-After header.

Error Handling

All API errors follow a consistent JSON structure. Use the status code and error details to handle failures gracefully.

Error Response Format


          

        


        
        

          
        

      


            

        
      


            
      

        

          
Schemas

          
Data models used across the API.

        


        

          

          
          

            No schemas match ""