Authentication
ProfileGlide uses two credentials for two different jobs: an authenticated account session manages your workspace; an API key runs data actions.
Account sessions
Signup, email confirmation, password login, session refresh, and password recovery are handled by Supabase Auth in ProfileGlide’s dedicated project. ProfileGlide does not maintain a separate password database or share Auth users with ColdGenius. Use at least 12 characters for passwords.
Create an account with your email and password, then verify the email before signing in. The API validates the token signature, issuer, audience, and subject. It also checks the authenticated user with Supabase, including the trusted email_confirmed_at value. User-editable metadata is not evidence of email verification.
| Operation | Credential |
|---|---|
| Create the workspace and receive the initial grant | Verified account session |
| Create, list, or revoke keys | Account session |
| Execute a live or async data action | API key only |
| Read workspace, runs, or outputs | API key or account session, within the same workspace |
| List supported actions | Public; no credential required |
API keys
Keys begin with sk_live_. Use the entire value as a Bearer token. There is no separate test-key mode; test requests spend the introductory credits just like other runs.
curl "$API_URL/v1/workspace" \
-H "Authorization: Bearer $API_KEY"Create a named key in the dashboard. The creation response includes api_key once. Subsequent listings expose id, prefix, name, created_at, and revoked_at, never the secret. The backend stores a cryptographic hash for lookup.
The 100-credit grant
The first verified workspace request creates the workspace and its credit ledger entry in the same transaction. The unique owner constraint prevents concurrent requests from creating duplicate grants. Returning sessions receive the existing balance.
The grant is one time, not a monthly free plan. Creating another key does not create another workspace or grant. Provider capacity limits still apply to free credits.
Verification and recovery
Use the verification email to confirm the account. A confirmation callback completes the session before opening the dashboard. If the message does not arrive, check spam and request a new email from the signup confirmation screen. Avoid repeated requests in quick succession.
Use password recovery when you cannot sign in. Reset links return to the recovery page, where you choose a new password. Recovery is only available on hosts configured with the authentication provider and its redirect allowlist.
Rotate a key
Create a replacement key, update your server configuration, verify a small request, then revoke the old key. Revocation stops new requests using that credential. It does not automatically cancel work already admitted into the queue.
Never put a secret in browser source, a public repository, an analytics event, or a URL. The dashboard playground accepts a pasted key in memory; it does not persist the key to local storage.
Troubleshooting
A 401 means the credential is missing, invalid, expired, revoked, or associated with an unverified account. A 403 means the credential is valid but cannot perform that operation—for example, a session token on an execution endpoint.
See errors for retry behavior. Signing out clears the browser session; revoke API keys separately when you intend to disable integrations.