> ## Documentation Index
> Fetch the complete documentation index at: https://grailx.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the SQR API using API keys or Supabase JWTs.

SQR supports two authentication methods. Both use the same `Authorization: Bearer` header.

## API keys (recommended)

API keys are 48-character hex strings. Create one from the dashboard or via the API.

```bash theme={null}
curl https://yys-sqr-render-bsbe.onrender.com/api/records \
  -H "Authorization: Bearer abc123def456..."
```

### Create a key

Sign in to the [Dashboard](https://yys-sqr-render-bsbe.onrender.com/dashboard), go to **API Keys**, and click **Create Key**. Or use the API:

```bash theme={null}
curl -X POST https://yys-sqr-render-bsbe.onrender.com/api/keys \
  -H "Authorization: Bearer YOUR_SUPABASE_JWT" \
  -H "Content-Type: application/json" \
  -d '{"name": "production"}'
```

<Note>
  Creating and managing API keys requires a Supabase JWT — you cannot use an API key to create another API key.
</Note>

### Revoke a key

```bash theme={null}
curl -X POST https://yys-sqr-render-bsbe.onrender.com/api/keys/3/revoke \
  -H "Authorization: Bearer YOUR_SUPABASE_JWT"
```

## Supabase JWT

If you're building a browser-based integration, use the Supabase JS client to get a session token:

```javascript theme={null}
const { data: { session } } = await supabase.auth.getSession();
const token = session.access_token;

fetch('/api/records', {
  headers: { 'Authorization': `Bearer ${token}` }
});
```

## Which endpoints require auth?

| Endpoint                      | Auth required  |
| ----------------------------- | -------------- |
| `GET /api/health`             | No             |
| `GET /api/templates`          | No             |
| `GET /api/records/:id`        | No             |
| `POST /api/records/:id/scan`  | No             |
| `POST /api/embed`             | No             |
| `POST /api/records`           | Yes            |
| `GET /api/records`            | Yes            |
| `PATCH /api/records/:id`      | Yes            |
| `POST /api/records/:id/mint`  | Yes            |
| `POST /api/records/:id/claim` | Yes            |
| `POST /api/keys`              | Yes (JWT only) |
| `GET /api/keys`               | Yes (JWT only) |