Authentication

Neverline uses Supabase Auth for authentication and authorization.

User Authentication

Staff and administrative users authenticate via Supabase's email/password flow. The dashboard client manages login processes and session state autonomously.

API Authentication

Protected API endpoints require a Supabase JWT token:

Authorization: Bearer <supabase-jwt-token>

Tokens are obtained through the Supabase Auth login flow and are automatically refreshed by the dashboard client.

API Keys

For server-to-server integrations, generate API keys in Settings → Integrations.

API keys are passed via the X-API-Key header:

X-API-Key: your-api-key

API keys are scoped to an organization and have the same permissions as an authenticated user within that organization.

Public Endpoints

The following endpoints are public and do not require authorization headers:

Endpoint	Purpose
GET /v1/queues/:id	Get queue info (for customer join page)
POST /v1/sessions/join	Join a queue
GET /v1/sessions/:token	Poll session status
POST /v1/sessions/:token/away	Set away status
POST /v1/sessions/:token/return	Return from away
POST /v1/sessions/:token/late	Mark as running late
GET /v1/announcements	Fetch active announcements (with scope params)
GET /v1/locations/:id	Get location details + wayfinding overrides
POST /v1/planned-arrivals	Create a pre-arrival signal
POST /v1/planned-arrivals/:token/convert	Convert planned arrival to queue session
GET /v1/chat/:token	Get/create chat thread
POST /v1/chat/:token/messages	Send a chat message

These endpoints use customer tokens for session identification rather than user authentication.

Deep-Link Signed URLs

Notification links (SMS/push) use HMAC-SHA256 signed URLs for one-tap actions. The signature prevents tampering and includes an expiration timestamp. See Notifications for details.

Row-Level Security (RLS)

All database access is protected by Supabase Row-Level Security policies ensuring organization-level data isolation. Users can only access data belonging to their organization.