Authentication

Use tenant-bound keys

For server-to-server applications, send X-API-Key with a gateway key issued from the target instance. Gatekeeper stores a hash of the key and binds it to that instance.

You may also send a JWT issued by Gatekeeper's own Supabase Auth in Authorization: Bearer … plus X-App-ID. The caller must own that instance, which must also be active and provisioned. JWTs issued by a separate customer Supabase project are not accepted.

Key hygiene

Keep gateway keys only in trusted server environments or an approved secret manager; do not embed them in browser/mobile apps.
Create separate keys for separate deployments and rotate immediately after suspected exposure.
Do not use the legacy shared-key compatibility mode for new integrations.