Authentication
FaceVerify v2.0 uses three different credential types. Each one has a different job, so keep them separate.
API keys
Server-to-server API calls use a bearer token:
Authorization: Bearer sk_live_...Use API keys for POST /v1/verify, GET /v1/sessions/:token, and your dashboard backend calls.
Dashboard session auth
The dashboard uses a Supabase session JWT. That is separate from API keys and only applies to your logged-in dashboard experience.
Hosted session token
The token in verify_url is the credential for the browser completion call. No API key is needed there because the request comes from the end user's browser. The token is short-lived, single-use, and stored hashed.
Never ship an API key to the browser. Only the hosted session token belongs in the browser flow.