BoltReply.io API authentication
Authenticate BoltReply.io API calls with a signed-in user's Supabase Bearer token.
Authenticated BoltReply.io API operations require a Supabase access token from a user who has signed in to BoltReply.io. There is no public API-key program.
Send a Bearer token
Include this header on authenticated /api/v1 requests:
Authorization: Bearer <supabase_access_token>For example, call POST /api/v1/ai/generate after the user has signed in and explicitly provided a valid session token. Do not ask a user to paste a password into an API request.
Token failures
A missing, invalid, or expired token produces HTTP 401 and a JSON error with code UNAUTHORIZED. The response hint tells the caller to obtain a current token by signing in. If the account profile has not completed signup, the API returns USER_NOT_FOUND with a next step.
Public demo tools
The public endpoints under /api/tools do not require a Bearer token, but they are rate limited. They are suitable for a demo, not a replacement for an account-scoped integration.
For exact requirements, use the OpenAPI specification.