Authentication
Choose the credential required by the exact API operation and keep customer identity in your application.
BusinessMode distinguishes the caller's identity boundary from the customer user's external ID. The API reference shows the exact OpenAPI security requirement on each operation.
| Reference requirement | Credential | Typical caller |
|---|---|---|
| Public | No BusinessMode bearer requirement | Public catalog or health; operation-specific validation can still apply |
| DeveloperBearer | BusinessMode developer Supabase JWT | Project and Workspace control-plane management |
| HumanBearer | BusinessMode human Supabase JWT | Organization-admin invitation acceptance and portal |
| MachineApiKey | bm_sk_... API key as Bearer credential | Customer backend integration |
Your customer application keeps its users, authentication, and sessions. Its backend supplies a stable externalUserId to BusinessMode. That external user is not normally a BusinessMode Supabase identity.
Keep bm_sk_... on your server. Never put it in browser or mobile client code. API keys are Project-scoped machine credentials; Access Codes and Customer Invitations are different bearer materials for customer provisioning, not general API authentication.
Machine operations include check access, assign seat, redeem Invitation, and redeem Access Code. Developer management uses list Projects or create License. The portal Organization list uses HumanBearer.
“Public” in OpenAPI means no BusinessMode bearer scheme. It does not mean a callback like Stripe's signed webhook is a general customer-facing endpoint.