Auth API Reference
Complete REST API reference for authentication endpoints. All requests require project-specific API keys.
API Keys
Every project has two JWT-signed API keys. Both are required for authentication operations.
anonPublic key - Safe to use in client-side code
Used for public operations like sign-up, sign-in, and read access with RLS policies.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ6ZW5kYngiLCJwcm9qZWN0X2lkIjoieW91ci1wcm9qZWN0LWlkIiwicm9sZSI6ImFub24ifQ...service_roleSecret key - Keep secure, never expose in client
Bypasses RLS policies. Use only in server-side code for admin operations.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ6ZW5kYngiLCJwcm9qZWN0X2lkIjoieW91ci1wcm9qZWN0LWlkIiwicm9sZSI6InNlcnZpY2Vfcm9sZSJ9...typescriptUsing API keys with SDK
// Get your keys from Dashboard → Project Settings → API Keys
const apiUrl = 'https://api.zendbx.in';
const anonKey = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'; // Public (safe to expose)
const serviceKey = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'; // Secret (keep secure)
const db = createClient({ apiUrl, anonKey, projectSlug: 'my-project' });⚠️The
service_role key bypasses Row Level Security. Never expose it in client-side code or public repositories.Sign Up
Create a new user account in the project.
http
POST /v1/auth/{project-id}/signup
Headers:
Content-Type: application/json
apikey: {anon-key}
Body:
{
"email": "user@example.com",
"password": "password123",
"name": "Jane Doe"
}
Response:
{
"user": {
"id": "uuid",
"email": "user@example.com",
"name": "Jane Doe"
},
"session": {
"access_token": "jwt-token",
"expires_at": 1234567890
}
}| Parameter | Type | Required | Description |
|---|---|---|---|
| string | required | Valid email address | |
| password | string | required | Minimum 6 characters |
| name | string | optional | Display name. Defaults to email prefix |
Sign In
Authenticate with email and password. Returns access token for subsequent requests.
http
POST /v1/auth/{project-id}/login
Headers:
Content-Type: application/json
apikey: {anon-key}
Body:
{
"email": "user@example.com",
"password": "password123"
}
Response:
{
"user": { ... },
"session": {
"access_token": "jwt-token",
"expires_at": 1234567890
}
}💡The returned
access_token must be sent as Authorization: Bearer <token> for authenticated endpoints.Get User
Retrieve the currently authenticated user's information.
http
GET /v1/auth/{project-id}/user
Headers:
Authorization: Bearer {access-token}
apikey: {anon-key}
Response:
{
"user": {
"id": "uuid",
"email": "user@example.com",
"name": "Jane Doe"
}
}Sign Out
Invalidate the current session.
http
POST /v1/auth/{project-id}/logout
Headers:
Authorization: Bearer {access-token}
apikey: {anon-key}
Response:
{
"message": "Signed out successfully"
}Reset Password
Initiate password reset flow. Sends reset email to user.
http
POST /v1/auth/{project-id}/reset-password
Headers:
Content-Type: application/json
apikey: {anon-key}
Body:
{
"email": "user@example.com"
}
Response:
{
"message": "Password reset email sent"
}Update Password
Complete password reset using token from email.
http
POST /v1/auth/{project-id}/update-password
Headers:
Content-Type: application/json
apikey: {anon-key}
Body:
{
"token": "reset-token-from-email",
"password": "newpassword123"
}
Response:
{
"message": "Password updated successfully"
}Error Responses
All endpoints return standard error responses:
json
{
"detail": "Error message",
"status_code": 400
}
Common status codes:
400 - Bad Request (invalid input)
401 - Unauthorized (invalid/missing token)
403 - Forbidden (insufficient permissions)
429 - Too Many Requests (rate limited)
500 - Internal Server Error