ZeroGrantZEROGRANT
Get API Keys

Sandbox API

Auth

Dashboard, ops, and marketing register all use Supabase email OTP (no passwords). They share the Auth project but use separate login audiences:

  • Developers: https://app.zerogrant.io/login then /app. Requires organisation membership.
  • Ops staff: https://ops.zerogrant.io/login then /console. Requires staff allowlist membership.

Cross-audience sign-in is rejected. Enter the 6-digit code, or use the email link (each app exposes /auth/callback). Local OTP messages land in Mailpit. After marketing register, request a new dashboard OTP (sessions do not cross localhost ports). Dashboard and ops SSR forward the Supabase OTP access token to the API ( organisation_members vs ops_staff). Product API keys remain Authorization: Bearer zg_test_... or zg_live_.... NTKA service calls use HMAC minted tokens between services only. Production owner approval is separate from dashboard login.