Endpoint Groups
Authentication
API routes use different auth models depending on the caller:- Supabase bearer token — user-facing requests from Charm Store / Studio.
- Runner secret — internal callbacks from the Cloud Runner.
- Cron secret — scheduled maintenance jobs.
- Stripe webhook secret — payment event verification.
Base URL
OpenAPI Spec
The raw specification powering this reference is available atopenapi.json. You can import it into Postman, Insomnia, or any OpenAPI-compatible tool.