Authentication

How Lynx authenticates requests — session token, publishable key, the org_id requirement and roles.

Lynx runs on Supabase. Every request to the API — invoicing or data — carries two headers:

Header	Value
Authorization	Bearer <access_token> — the session token of a signed-in user.
apikey	The deployment’s publishable key.

You obtain the session token with Supabase Auth (Google or Microsoft account, or email and password). It is short-lived; refresh it with the Supabase client rather than storing it.

org_id is required

Every invoicing operation needs org_id in the body. A request without it is rejected with 400. The token must belong to a member of that organization.

Roles

• The /integrations/* operations (credentials for invoicing providers) require the admin role.
• The rest of the invoicing operations require admin or operador.
• Data reads over the lynx schema are limited by row-level security (RLS): you only see what your session is allowed to see.