Authentication

How every GraphQL request is authorized.

Updated 2026-08-25 · 1 min read

The API speaks GraphQL over POST at the same-origin proxy path /api/graphql. Every request carries a Firebase ID token:

Authorization: Bearer <firebase-id-token>

Rules

Tokens are short-lived; clients refresh via Firebase SDK flows.
The server maps token email → profile and enforces cohort boundaries (public vs internal_test).
Blocks, moderation states, and KYC guardrails apply to every request identically.

Explore individual fields in the API explorer.