Authentication

In-browser sign-in

• Email + password — enforces email confirmation before first sign-in.
• Google OAuth — one-click sign-in; requires the same verified email.
• Magic link and password reset — delivered from support@osints.xyz.

Obtaining an API token

The REST API accepts any valid Supabase session access token. In the browser you can read it from the client:

import { supabase } from "@/integrations/supabase/client";

const { data } = await supabase.auth.getSession();
const token = data.session?.access_token;

Programmatic sign-in (server side)

import { createClient } from "@supabase/supabase-js";

const supabase = createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
  auth: { persistSession: false },
});
const { data } = await supabase.auth.signInWithPassword({
  email: process.env.OSINTS_EMAIL!,
  password: process.env.OSINTS_PASSWORD!,
});
const token = data.session!.access_token;

Token lifetime

Access tokens expire in ~1 hour. Use refresh_token to mint a new access token, or re-run signInWithPassword before it expires.