The SDKs call this API for you. You call it directly from your backend to mint tokens, export or delete a user's data, and when you build your own client.
Base URL
Every app has its own base URL, shown in the dashboard. These docs write it as
{TWEAKLANE_URL}; it has the form https://<project>.supabase.co/functions/v1/tweaklane. Paths
below are relative to it. Requests and responses are JSON (UTF-8).
Authentication
| Caller | Headers |
|---|---|
| SDK (a user's device) | x-tweaklane-key: tl_pk_… and Authorization: Bearer <user token> |
| Anonymous token request | x-tweaklane-key: tl_pk_… only |
| Your backend | Authorization: Bearer tl_sk_… |
The secret key tl_sk_… is also the HS256 signing secret for user tokens. Keep it on your
servers.
User tokens
An HS256 JWT with the claims iss (your app id), sub (your user id, 1–256 characters), aud
("tweaklane"), iat and exp. The lifetime is at most 3600 seconds, configurable per app. Sign
it yourself (see Connect your backend) or call POST /tokens.
POST /tokens
Mints a user token. Server to server, secret key.
POST {TWEAKLANE_URL}/tokens
Authorization: Bearer tl_sk_…
Content-Type: application/json
{ "userId": "user-123", "ttlSeconds": 900 }
| Field | Type | |
|---|---|---|
userId |
string, 1–256 printable characters, not starting with anon: |
required; becomes the token's sub |
ttlSeconds |
integer | optional; 60 up to the app's maximum lifetime (the default) |
200, expiresAt in seconds since the epoch:
{ "token": "eyJhbGciOiJIUzI1NiIs…", "expiresAt": 1794050100 }
POST /tokens/anonymous
Mints a token for a device without an account. Public key only.
POST {TWEAKLANE_URL}/tokens/anonymous
x-tweaklane-key: tl_pk_…
Content-Type: application/json
{ "installId": "6f1c2a9e-4b7d-4c1e-9a55-0d2f7c3e8b61" }
installId is 16–64 characters of A–Z a–z 0–9 -. The token's subject is anon:<installId>.
Returns {token, expiresAt}; the token lives 900 seconds. Off by default: switch anonymous users on
per app in the dashboard. While off, the route answers 403 anonymous_disabled.
Next: API: SDK routes.