API keys (Public Metrics API)
The versioned/api/v1/* endpoints on the web app authenticate with long-lived Ansvisor API keys (prefix ans_), created under Settings → API Keys in the dashboard:
Bearer token
All/api/* endpoints on the Ansvisor server require a Supabase JWT bearer token in the Authorization header:
Getting a token
The cleanest way is via the Supabase JS client in your own backend code:Cron endpoints
A handful of internal endpoints (used by Vercel Cron and Stripe success callbacks) authenticate via a sharedCRON_SECRET instead of user tokens:
Public endpoints
Three endpoints don’t require any auth:GET /t.js— tracking pixel scriptPOST /t/collect— tracking pixel beacon (validates origin againstbrand_domains)GET /healthz(where exposed) — basic uptime check
The internal
/api/health endpoint described in the routes file IS
auth-protected — by design, it returns the authenticated user’s ID. For uptime
monitoring, use /t.js instead (returns 200 + JS content).Continue: Brands API
CRUD endpoints for managing brands programmatically.