Authentication

Overview

BusyBook uses Supabase for authentication and API access. All API requests go through the Supabase REST API at https://api.busybook.co/rest/v1/.

Authentication Methods

Session-Based (Platform UI)

When you log in to the BusyBook platform, authentication is handled automatically via Supabase Auth. Your session token is managed by the application — no manual configuration needed.

API Key (Programmatic Access)

For programmatic access (e.g., integrations, scripts, or the assistant), API requests use the Supabase apikey header:

curl -s "https://api.busybook.co/rest/v1/appointments" \
  -H "apikey: YOUR_SUPABASE_ANON_KEY" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json"

Required Headers

Every API request must include:

Header	Value	Purpose
apikey	Your Supabase anon key	Identifies the project
Authorization	Bearer <jwt_token>	Authenticates the user
Content-Type	application/json	For POST/PATCH requests

Row-Level Security (RLS)

All tables are protected by Row-Level Security. This means:

• You can only access data belonging to your practice (therapist_id = auth.uid())
• Cross-tenant data access is impossible at the database level
• Even if you construct a query without a therapist_id filter, RLS enforces the scope

Rate Limits

The API enforces rate limits to prevent abuse:

Endpoint Type	Limit
Read (GET)	100 requests/minute
Write (POST/PATCH/DELETE)	30 requests/minute
Auth (login/signup)	10 requests/minute

If you hit a rate limit, the API returns 429 Too Many Requests. Wait and retry after the indicated period.

Error Responses

All errors follow a standard format:

{
  "message": "Description of what went wrong",
  "code": "ERROR_CODE",
  "hint": "Optional suggestion for how to fix it"
}

Common error codes:

Status	Meaning
400	Bad request — check your request body
401	Unauthorized — invalid or expired token
403	Forbidden — RLS denied access to this resource
404	Not found — the resource doesn’t exist
409	Conflict — duplicate entry or constraint violation
429	Rate limited — slow down
500	Server error — contact support