Authentication

API keys, dashboard JWTs, and how to authenticate every request.

BlobRouter v0.1 · Last updated: August 2026 · Architecture version: 2.0

Two auth modes

Mode	Header	Used for
API key	Authorization: Bearer br_live_… or br_test_…	SDK router: upload, get, delete, /v1/me
Dashboard JWT	Authorization: Bearer <supabase_access_token>	Scanner, providers, analytics, billing, key rotate

curl https://api.blobrouter.com/v1/me \
  -H "Authorization: Bearer $BLOBROUTER_API_KEY"

API keys

• Format: br_live_{uuid} or br_test_{uuid}
• Create / view in the dashboard (Providers → API key)
• Rotate with POST /v1/keys/rotate — old key invalid immediately

Never embed keys in browsers, mobile apps, or public repos.

Dashboard JWT

Obtained from Supabase Auth after login. The dashboard attaches it automatically. For scripting, use a short-lived access token from your session.

Failures

Status	Code	Meaning
401	unauthorized	Missing/invalid key or JWT

See Errors.