Developers
Browser sessions, bearer tokens, OAuth discovery, and MCP authentication for developers.
CentraKit developer surfaces use the same Supabase-backed auth model as the SaaS app, exposed through request-scoped services at each boundary.
Browser requests use Supabase session cookies managed by @supabase/ssr. SaaS routes are protected by the proxy and deeper page/action checks.
API, CLI, and MCP clients can pass access tokens as bearer tokens. This is the preferred path for scripts, CI, and external tools.
Authorization: Bearer <access-token>MCP clients discover the protected resource metadata at:
https://api.centrakit.com/.well-known/oauth-protected-resourceLocal development uses:
https://api.localhost/.well-known/oauth-protected-resourceThe metadata points clients to the Supabase authorization server for OAuth 2.1 flows.
Authentication failures are mapped to domain errors before they reach app or API callers. Public surfaces should avoid leaking account-state-specific details and should treat expired or reset local sessions as recoverable sign-in problems.