API status and contracts
Understand the public status surface and authenticated API boundary.
Current access model
Xroga application APIs use Supabase sessions for authenticated requests. The public release/status surface exposes safe build identity, while project and user operations require authorization. There is no general public customer API commitment documented here.
Do not ship private credentials
Use public Supabase URL and publishable key in the browser. Keep service-role keys, database URLs, provider tokens, and webhook secrets on the server.