Authentication

SuitePortal uses Better Auth for authentication, supporting multiple methods for different use cases.

Authentication Methods

Method	Use Case	Description
API Keys	Server-to-server	Bearer token for programmatic API access
Social Login	Portal users	Google, GitHub, Microsoft OAuth
Email OTP	Portal users	Passwordless one-time code
Email + Password	Portal users	Traditional credentials

For programmatic API access, use API keys in the Authorization header.

Authorization: Bearer sp-{timestamp}-{hash}

curl -X GET "https://suiteportal.io/api/v1/invoices" \
  -H "Authorization: Bearer sp-1703123456789-abc123def456"

See API Keys for instructions on creating and managing keys.

Portal users (customers, vendors, employees) authenticate via the web interface.

Passwordless login via one-time code sent to email:

Traditional email and password authentication is supported.

API keys and sessions are scoped to an organization:

Portal Type	Data Access
Tenant	All organization data
Customer	Only customer's data (RLS filtered)
Vendor	Only vendor's data (RLS filtered)

The tenantId is automatically derived from the authenticated context—no tenant parameter is required in API requests.

For AI/LLM integrations via the Model Context Protocol, OAuth 2.0 is used:

OAuth tables required:

Status	Error	Cause
401	`API key required`	Missing Authorization header
401	`Invalid API key`	Key not found or expired
403	`Access denied`	User not organization member