Skip to content

Supabase Auth

Sign-in

Staff, portal users and the mobile app sign in with email and password through Supabase Auth.

The API verifies every token against the issuer’s published keys (JWKS), then resolves the caller’s organizations and role from its own tables, never from claims in the token.

Staff accounts are invite-only. Portal users are a separate identity created by a staff invitation, and they are never org members.