Authenticate requests to the InfraAudit API

All protected InfraAudit API endpoints require a Bearer token in the Authorization header. This page explains how to obtain a token, how to use it, and how long-lived API keys work.

Pass the token

Include your token on every request:

Authorization: Bearer <access_token>

Get a token

InfraAudit uses Supabase Auth. Your access token is a signed JWT issued by your Supabase project. There are three ways to obtain one.

Option 1: Sign in via the Supabase client

Use the Supabase JavaScript SDK if you’re building a browser or Node.js integration:

import { createClient } from '@supabase/supabase-js'

const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY)

const { data, error } = await supabase.auth.signInWithPassword({
  email: 'user@example.com',
  password: 'your-password',
})

const token = data.session.access_token

Option 2: Sign in via the InfraAudit API

POST your credentials to /api/login to receive a token directly:

curl -X POST https://api.infraaudit.dev/v1/api/login \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "your-password"}'

Response:

{
  "user": {
    "id": 1,
    "email": "user@example.com",
    "role": "user"
  },
  "token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Option 3: Use the CLI

The CLI stores the token automatically after login:

infraudit auth login --email user@example.com --password your-password

The token is saved to ~/.infraudit/config.yaml and used by all subsequent CLI commands.

Use the token in requests

export TOKEN="eyJhbGciOi..."

curl https://api.infraaudit.dev/v1/resources \
  -H "Authorization: Bearer $TOKEN"

API keys

For non-interactive use cases such as CI/CD pipelines and automated scripts, create a long-lived API key instead of using a session token. Create an API key in the web UI: navigate to Settings → API Keys and click New key. Create an API key via the API:

curl -X POST https://api.infraaudit.dev/v1/settings/api-keys \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "CI/CD Pipeline"}'

Response:

{
  "id": 2,
  "name": "CI/CD Pipeline",
  "key": "ia_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

The full API key value is returned only at creation time. Store it in your secrets manager immediately — it cannot be retrieved again.

API keys use the same Authorization: Bearer header as session tokens.

Token format

Tokens are Supabase JWTs signed with either:

ES256 — ECDSA with a key pair managed by Supabase, verified via JWKS at {SUPABASE_URL}/auth/v1/.well-known/jwks.json
HS256 — HMAC using SUPABASE_JWT_SECRET

The auth middleware accepts both formats.

SSE / EventSource requests

For server-sent events endpoints, pass the token as a query parameter instead of a header:

GET /api/ws/drifts?token=eyJhbGciOi...

401 vs 403

Status	Meaning
`401 Unauthorized`	No token provided, token expired, or token is invalid
`403 Forbidden`	Token is valid but the user lacks permission for this resource

Overview

Endpoints

Webhooks

Examples

Authenticate requests to the InfraAudit API

Pass the token

Get a token

Use the token in requests

API keys

Token format

SSE / EventSource requests

401 vs 403

​Pass the token

​Get a token

​Use the token in requests

​API keys

​Token format

​SSE / EventSource requests

​401 vs 403

Pass the token

Get a token

Use the token in requests

API keys

Token format

SSE / EventSource requests

401 vs 403