Authentication

The Simplio3D API uses JWT tokens for authentication. All API requests must include a valid access token.

Sign Up

const response = await fetch(BASE_URL + '/auth/signup', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    email: '[email protected]',
    password: 'securePassword123',
    name: 'John Doe'
  })
});

const data = await response.json();
// { "success": true, "userId": "...", "message": "Account created" }

Sign In

import { createClient } from '@supabase/supabase-js';

const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);

const { data: { session }, error } = await supabase.auth.signInWithPassword({
  email: '[email protected]',
  password: 'securePassword123'
});

// Use session.access_token for all API calls
const accessToken = session.access_token;

Get Session

const response = await fetch(BASE_URL + '/auth/session', {
  headers: { 'Authorization': 'Bearer ' + accessToken }
});

const data = await response.json();
// { "success": true, "userId": "...", "email": "[email protected]" }

API tokens (X-API-Key)

An account can issue a long-lived API token from Profile → API/SDK for server-to-server automation. It is sent in its own header:

An API token does not replace an access token. It is accepted on a deliberately narrow set of endpoints — everything else returns 401:

So an API token can read and author a project’s option blocks and pricing, but cannot fetch the project itself. If you need the full surface, sign in and use the resulting access token.

CORS

The API answers cross-origin browser requests by reflecting the requesting origin back in Access-Control-Allow-Origin and setting Access-Control-Allow-Credentials: true. There is no origin allow-list to register, so a browser on any domain can call the API — what it may send is constrained by the header list below, and what it may do is constrained by the credential it presents.