Skip to main content

​
Authentication

DalyAPI uses JWT bearer tokens for protected endpoints.

​
Flow 1: API Key Exchange

Use workspace + user API keys to request a JWT. Endpoint: POST /auth/token
Returns:

​
Flow 2: Supabase Exchange

If your client already has a Supabase token:
  1. GET /auth/workspaces to list accessible workspaces
  2. POST /auth/exchange-supabase with chosen workspace_id
Both endpoints require:

​
Use the Daly JWT

For protected routes:
Example:

​
JWT Claims (Server-Validated)

Core claims used by API dependencies:
  • workspace_id
  • user_id
  • organization_id (optional)
  • workspace_role (optional, refreshed from DB)
Keep API keys and JWTs server-side where possible. Workspace and user API keys are long-lived credentials.