API Authentication

The current state, plainly

The Neo Dialer API is the same API the web application uses. It authenticates with a bearer token issued by the platform's auth provider — the same session token your browser holds when signed in.

Long-lived API keys are not yet issued. The API Keys screen under Admin → Security is a placeholder: it renders a key in the browser but no key is stored and none will authenticate. If you are planning an integration around that screen, stop and talk to us first.

We would rather tell you this than let you build against something that does not exist.

Authenticating

Every request carries the token in an Authorization header:

Authorization: Bearer <token>

The token identifies the user, and the user's organisation determines which tenant's data the request can reach. There is no tenant parameter to set — attempting to reach another organisation's data returns nothing, not someone else's records.

Obtaining a token

Tokens are issued by the platform's authentication provider when a user signs in. For a server-side integration, authenticate as a dedicated service user in your tenant and use the token from that session, refreshing it as it expires.

POST https://<your-supabase-project>.supabase.co/auth/v1/token?grant_type=password
Content-Type: application/json
apikey: <your anon key>

{
  "email": "integration@yourcompany.com",
  "password": "..."
}

The response carries access_token and refresh_token. Use the access token as the bearer, and refresh it before it expires.

Contact us for your project's URL and anon key — they are specific to your deployment.

Roles apply

The API enforces the same role hierarchy as the interface. A token belonging to an agent cannot reach admin endpoints. Create your integration user with the narrowest role that covers what it needs.

Multi-factor authentication

If your organisation requires MFA, an integration user is subject to it too. Plan for that: either exempt a dedicated service account, or complete enrolment for it during setup.

Errors

A 404 for a record you believe exists usually means it belongs to a different organisation than your token does.