One API. A few ways in.

Make a secured request

Sign in with your Supabase account in the playground. The app includes your session token automatically when you choose Secured.

For your own client, send a signed-in user’s Supabase access token in the Authorization header on every request. A publishable API key is not a user token.

curl https://htp-api-kerry-hatcher.fly.dev/secured \
  -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN"

Connect an MCP client

Choose Streamable HTTP and paste one of the MCP URLs above. For the secured endpoint, configure Authorization: Bearer <access_token> as a request header.

Connections are stateless. The protected endpoint checks authentication for initialization, discovery, and every tool call. Use an existing Supabase session token; automatic OAuth login is not provided.

Your Supabase project

Email confirmation is required when you create an account. Once you confirm, return to the playground and sign in. Sessions refresh automatically while you use the app.