# Authentication

> Session auth for dashboard APIs and secrets for webhooks/cron.

# Authentication

## Dashboard session

Browser users authenticate with Supabase Auth (Google OAuth, magic link, or password). Dashboard API routes read the session cookie via `getAuthContext()`.

Unauthenticated calls receive `401`.

## Cron & webhooks

| Route | Auth |
| --- | --- |
| `POST /api/webhook/stripe` | Stripe signature header |
| `POST /api/webhooks/apify` | Job id query + Apify payload |
| `GET /api/cron/refresh` | `Authorization: Bearer CRON_SECRET` |
| `GET /api/cron/alerts` | `Authorization: Bearer CRON_SECRET` |

## Agent guidance

AI assistants must never ask users to paste secrets into chat. Prefer environment variables and the dashboard session.