reference

Authentication

Overview of Postbase authentication — dashboard auth, API keys, JWT, and the full SDK Auth API.

Published: March 22, 2026Updated: March 22, 2026

Authentication

Postbase ships with two authentication systems: dashboard auth for the Postbase admin UI, and the SDK Auth API for your end-user applications.

API Keys

Every project has two API keys generated with nanoid:

  • pb_anon_<64chars> — Anon key. Used by end-user clients. Subject to RLS policies.

  • pb_service_<64chars> — Service role key. Bypasses RLS. Only for trusted server-side code.

All SDK API routes require the anon key (or service key for admin endpoints) in the Authorization: Bearer <key> header.

JWT Tokens

Postbase uses a lightweight HS256 JWT implementation via the Web Crypto API — no external library required. It works in Node 18+ and Edge runtime.

Token TTLs: access token = 1 hour, refresh token = 7 days (rotated on every use).

JWT payload shape:

{ "sub": "<userId>", "pid": "<projectId>", "email": "user@example.com", "role": "authenticated", "iat": 1700000000, "exp": 1700003600 }

  1. Client calls POST /api/auth/v1/otp with the user email.

  2. Postbase sends a magic link email via nodemailer.

  3. User clicks the link → GET /api/auth/v1/verify issues a session, sets the postbase-session cookie, and redirects.