Backend service token

Pattern used by password-reset and webhook backends:

1. The browser logs in with @kataflax/sdk and sends the project JWT to your API (cookie or Authorization).
2. Your server holds TEFILY_SERVICE_TOKEN (kfxs_…) and never returns it to the client.
3. The server calls POST /api/p/:projectId/auth/verify to validate the user JWT.
4. The server uses the service token to read/write collections (rules are bypassed — only do what the user is allowed to, in your own code).

const projectId = process.env.TEFILY_PROJECT_ID!;
const serviceToken = process.env.TEFILY_SERVICE_TOKEN!;
const api = process.env.TEFILY_API_URL ?? 'https://api.tefily.com';

async function verifyProjectJwt(token: string) {
  const res = await fetch(`${api}/api/p/${projectId}/auth/verify`, {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${serviceToken}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ token }),
  });
  const json = await res.json();
  if (!json.success || !json.data?.valid) throw new Error('Invalid session');
  return json.data.user;
}

Create the token in the console (project Developers / service tokens). Rotate it if it leaks.

Dart equivalent: KataflaxClient(..., serviceToken: 'kfxs_…') then auth.verify.

Do not use a PAT (kfx_…) for this: PATs are user-scoped platform credentials and can call console APIs.