Skip to main content
The Supapost API supports two authentication methods.

​
API key

For server-to-server integrations, use an API key. Create one in Settings → Developer in the dashboard — keys are prefixed sp_live_... and scoped to your team.
API keys are verified through Unkey on every request and inherit all permissions of the team owner (full access to team resources).

​
Supabase JWT

The web app authenticates via Supabase JWT tokens. The frontend manages these automatically — you only need to handle them yourself when building a custom integration against the same backend.
Tokens are verified against the Supabase project’s public JWKS (ES256). No shared secret is required.

​
Unauthenticated endpoints

A small number of routes are intentionally public: All other routes require an Authorization: Bearer ... header and will return 401 without one.

​
Rate limits

Limits are applied per-team across three buckets: Exceeding a limit returns a 429 response with a Retry-After header indicating when to retry:
Rate limits are enforced by Cloudflare’s native rate-limiting API. Counters reset every 60 seconds.