Skip to main content

Authentication

DealMeld accepts bearer credentials in the Authorization header.

Authorization: Bearer <token>
x-tenant-id: <tenant uuid>

User JWTs​

User JWTs are issued by DealMeld's Supabase Auth-backed sign-in flow. Browser clients normally receive and refresh these automatically.

Use a user JWT when the integration is acting as a signed-in human user.

API access keys​

Tenant owners and admins can create API access keys from Settings > API Access. API access keys are tenant-scoped service-account tokens, shown once at creation, stored only as hashes, and revocable without rotating a human user's password.

Use an API access key when a server, automation runner, or external system needs scoped tenant access.

curl \
  -H "Authorization: Bearer dmagt_<public>_<secret>" \
  -H "x-tenant-id: 550e8400-e29b-41d4-a716-446655440000" \
  "https://api.dealmeld.io/api/companies"

Security notes​

  • Never put API access keys in browser code.
  • Store service credentials in a server-side secret manager.
  • Send x-tenant-id on every tenant-scoped request.
  • Revoke unused keys from Settings > API Access.
  • Scope keys to the minimum resource permissions needed.