> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate requests to the InfraAudit API

> Get an InfraAudit API key from the dashboard, pass it as a Bearer token on every request, and understand what 401 and 403 errors mean for your integration.

All protected InfraAudit API endpoints require a Bearer token in the `Authorization` header. This page explains how to obtain a token, how to use it, and how long-lived API keys work.

## Pass the token

Include your token on every request:

```http theme={null}
Authorization: Bearer <access_token>
```

## Get a token

InfraAudit uses [Supabase Auth](https://supabase.com/docs/guides/auth). Your access token is a signed JWT issued by your Supabase project. There are three ways to obtain one.

<Steps>
  <Step title="Option 1: Sign in via the Supabase client">
    Use the Supabase JavaScript SDK if you're building a browser or Node.js integration:

    ```javascript theme={null}
    import { createClient } from '@supabase/supabase-js'

    const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY)

    const { data, error } = await supabase.auth.signInWithPassword({
      email: 'user@example.com',
      password: 'your-password',
    })

    const token = data.session.access_token
    ```
  </Step>

  <Step title="Option 2: Sign in via the InfraAudit API">
    POST your credentials to `/api/login` to receive a token directly:

    ```bash theme={null}
    curl -X POST https://api.infraaudit.dev/v1/api/login \
      -H "Content-Type: application/json" \
      -d '{"email": "user@example.com", "password": "your-password"}'
    ```

    Response:

    ```json theme={null}
    {
      "user": {
        "id": 1,
        "email": "user@example.com",
        "role": "user"
      },
      "token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..."
    }
    ```
  </Step>

  <Step title="Option 3: Use the CLI">
    The CLI stores the token automatically after login:

    ```bash theme={null}
    infraudit auth login --email user@example.com --password your-password
    ```

    The token is saved to `~/.infraudit/config.yaml` and used by all subsequent CLI commands.
  </Step>
</Steps>

## Use the token in requests

```bash theme={null}
export TOKEN="eyJhbGciOi..."

curl https://api.infraaudit.dev/v1/resources \
  -H "Authorization: Bearer $TOKEN"
```

## API keys

For non-interactive use cases such as CI/CD pipelines and automated scripts, create a long-lived API key instead of using a session token.

**Create an API key in the web UI:** navigate to **Settings → API Keys** and click **New key**.

**Create an API key via the API:**

```bash theme={null}
curl -X POST https://api.infraaudit.dev/v1/settings/api-keys \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "CI/CD Pipeline"}'
```

Response:

```json theme={null}
{
  "id": 2,
  "name": "CI/CD Pipeline",
  "key": "ia_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
```

<Warning>
  The full API key value is returned only at creation time. Store it in your secrets manager immediately — it cannot be retrieved again.
</Warning>

API keys use the same `Authorization: Bearer` header as session tokens.

## Token format

Tokens are Supabase JWTs signed with either:

* **ES256** — ECDSA with a key pair managed by Supabase, verified via JWKS at `{SUPABASE_URL}/auth/v1/.well-known/jwks.json`
* **HS256** — HMAC using `SUPABASE_JWT_SECRET`

The auth middleware accepts both formats.

## SSE / EventSource requests

For server-sent events endpoints, pass the token as a query parameter instead of a header:

```
GET /api/ws/drifts?token=eyJhbGciOi...
```

## 401 vs 403

| Status             | Meaning                                                        |
| ------------------ | -------------------------------------------------------------- |
| `401 Unauthorized` | No token provided, token expired, or token is invalid          |
| `403 Forbidden`    | Token is valid but the user lacks permission for this resource |