Authentication

How authentication and user sessions work in Apollo.

Authentication Overview

Apollo uses Supabase Auth with JWT-based authentication. All API requests require a valid JWT token passed in the Authorization header.

Sign-In Methods

Email & Password

The standard sign-in method. Users register with email and password, then confirm their email via a verification link.

1. Navigate to the login page at apol.dev
2. Enter your email and password
3. Click Sign In

Invitation

Organization admins can invite users via email. Invited users receive a link to set their password and join the organization.

1. Admin sends invitation from Organization Settings > Members
2. User clicks the invitation link in their email
3. User sets their password and is automatically added to the organization

Password Reset

1. Click Forgot Password on the login page
2. Enter your email address
3. Click the reset link in your email
4. Set a new password

Session Management

• Sessions are managed by Supabase with automatic token refresh
• Navigation history is persisted in localStorage so you return to where you left off
• Sessions persist across browser refreshes

User Types

Apollo supports three user types, determined by organization membership:

User Type	Description	Access
Internal	Full team members (org roles: owner, admin, member)	All features based on role
Customer	External clients with limited view	Simplified dashboard, assigned projects only
External Collaborator	Third-party contributors	Specific project access only

User types are derived from the organization_members role, not set directly. An external_collaborator org role maps to the External Collaborator user type.

Permission Model

Apollo uses a three-tier permission model. See Permissions for the full breakdown.