Authentication

Access token

The API authenticates requests with a Firebase ID token (JWT), sent in the Authorization header as a Bearer token:

Authorization: Bearer <token>

You obtain the token the same way as when signing into the web console or the mobile app — through Firebase Authentication. The API verifies the token's signature, issuer, and expiry.

First call (account provisioning)

On the first successfully authenticated request, the API automatically creates a local user account linked to the Firebase identity — there is no separate registration step on the API side. Subsequent requests from the same user refresh account details (such as the email address) if they changed in Firebase.

Organization context

Since a single user can belong to multiple organizations, every request must indicate which organization it applies to. This is done with a header:

X-Organization-Id: <organization id>

If the header is omitted, the API also checks whether an organization id is encoded directly in the token. In practice we recommend always sending the X-Organization-Id header explicitly — it's the only unambiguous way to pick an organization when an account belongs to more than one.