RetensisDashboard

API

API authentication

Choose the correct Retensis authentication model for a product, mobile, MCP, webhook, or scheduled caller.

LiveAll plans

Authentication models

  • Web product routes use the authenticated Supabase session.
  • Supported mobile routes can validate a Supabase JWT from Authorization: Bearer.
  • MCP uses Retensis-issued opaque OAuth access tokens at the resource boundary.
  • Edge Functions are invoked server-side and require service-role authentication internally.
  • Stripe and RevenueCat webhooks verify provider-specific signatures.
  • Scheduled routes verify cron, queue, or service secrets.

Tenant isolation

Identifiers in a request never establish ownership by themselves. Retensis resolves the authenticated user, then scopes reads and writes through RLS or an explicit owner predicate.