Quickstart

Create a key, trade it for a token, and make your first call in about five minutes.

Basics

Token endpoint	https://www.saficonfirm.com/api/v1/token
Data API	https://nvkkanirwnjjvuwxsjch.supabase.co/rest/v1
Auth	An API key traded for an access token that lasts one hour
Content type	application/json
Scoping	The database scopes every row to your own workspace

Four steps

1Create a key under Dashboard, API keys. The full key is shown once, so copy it into your server environment before you close the dialog.
2POST the key to the token endpoint. You get back an access token plus the project URL and publishable key you need for every call after it.
3Call the Data API with two headers: apikey carrying the publishable key, and Authorization carrying the access token.
4Cache the token and exchange again when the hour is up. Do not exchange on every request, that is what the rate limit is there to stop.

First request

cURL

curl -X POST https://www.saficonfirm.com/api/v1/token \
  -H "Authorization: Bearer sk_live_..."

Response

200 OK

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "bearer",
  "expires_in": 3600,
  "project_url": "https://nvkkanirwnjjvuwxsjch.supabase.co",
  "publishable_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

expires_in is the real lifetime in seconds, so schedule your next exchange against it rather than assuming an hour forever.

Read your orders back

cURL

curl "https://nvkkanirwnjjvuwxsjch.supabase.co/rest/v1/orders?select=id,client_name,status&order=created_at.desc&limit=5" \
  -H "apikey: $PUBLISHABLE_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Accept-Profile: public"

Both headers are required. apikey identifies the project, Authorization identifies you, and the rows that come back are only the ones your workspace can see.

Orders that get called

Reads are the same wherever they come from, but creating an order is not. An order only enters the calling queue when the workspace has an agent flagged as the order handler, and only when it is created through the dashboard or an import, which is what attaches the operation to that agent. A row inserted straight into the orders table through the Data API is stored and readable, but nobody will call it. Reading results back is covered in Reading results.