Skip to main content

​
Authentication

All API requests require a valid Supabase JWT token in the Authorization header: 
curl -H "Authorization: Bearer <your-jwt-token>" \
  https://api.apol.dev/api/v1/agent/sessions

​
Obtaining a Token

Tokens are obtained through Supabase Auth:
  1. Login via Supabase Auth (email/password)
  2. Receive access token and refresh token
  3. Include the access token in all API requests
  4. Refresh tokens automatically when they expire

​
Token Validation

The backend validates tokens using the Supabase JWT secret. Invalid or expired tokens return: 
{
  "detail": "Invalid or expired token",
  "status_code": 401
}

​
Feature Guards

Some endpoints are protected by feature guards. If a feature is disabled for your team, the endpoint returns: 
{
  "detail": "Feature not available",
  "status_code": 403
}

​
Organization Context

Most endpoints require an organization context, passed via the X-Organization-ID header or inferred from the authenticated user’s active organization.