Authentication

Common auth methods

Method	Used for
Supabase session cookies	Dashboard and user-authenticated API routes.
Scoped API keys	Chatbot widgets, external products, and product APIs.
Install tokens	One-time Hermes installation.
Telemetry tokens	Hermes event ingestion.
HMAC signing	Server-to-worker calls such as developer automation.

For server-to-server APIs, prefer:

Authorization: Bearer <token>
Content-Type: application/json

Never log full token values. Store tokens in environment variables or a secret manager.