Authentication

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/egeuysall/ryva-archive/llms.txt

Use this file to discover all available pages before exploring further.

​

Overview

​

Authentication Flow

1. User signs up or logs in through Supabase Auth
2. Supabase returns a JWT access token
3. Include the token in the Authorization header for API requests
4. The API validates the token with Supabase

​

Getting a Token

import { createClient } from '@supabase/supabase-js'

const supabase = createClient(
  'https://your-project.supabase.co',
  'your-anon-key'
)

// Sign up
const { data, error } = await supabase.auth.signUp({
  email: 'user@example.com',
  password: 'secure-password'
})

// Sign in
const { data, error } = await supabase.auth.signInWithPassword({
  email: 'user@example.com',
  password: 'secure-password'
})

// Access token
const token = data.session.access_token

​

Making Authenticated Requests

curl https://api.ryva.com/v1/auth/me \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

​

Token Validation

1. Verifying the JWT signature using the Supabase JWT secret
2. Checking token expiration
3. Extracting user information from the token claims

​

Authentication Errors

​

Missing Token

{
  "error": {
    "message": "Missing authorization header",
    "code": "UNAUTHORIZED",
    "status": 401
  }
}

​

Invalid Token

{
  "error": {
    "message": "Invalid or expired token",
    "code": "UNAUTHORIZED",
    "status": 401
  }
}

​

Insufficient Permissions

{
  "error": {
    "message": "You don't have permission to access this resource",
    "code": "FORBIDDEN",
    "status": 403
  }
}

​

Token Lifecycle

​

Token Expiration

​

Refreshing Tokens

const { data, error } = await supabase.auth.refreshSession()
const newToken = data.session.access_token

​

Revoking Tokens

await supabase.auth.signOut()

​

Public Endpoints

• GET /health - Health check
• POST /v1/waitlist - Join waitlist
• POST /v1/billing/webhooks/stripe - Stripe webhooks (verified by signature)

​

User Context

• User ID: Extracted from the JWT sub claim
• Email: Extracted from the JWT email claim
• Roles: Determined by organization membership

• Verify resource ownership
• Enforce role-based access control
• Audit actions

​

Security Best Practices

1. Store tokens securely: Use secure storage mechanisms (e.g., httpOnly cookies, secure storage APIs)
2. Use HTTPS: Always make API requests over HTTPS in production
3. Implement token refresh: Refresh tokens before they expire
4. Handle errors gracefully: Catch authentication errors and prompt users to re-authenticate
5. Rotate secrets: Regularly rotate your Supabase JWT secret

​

Next Steps