Service tokens

Tefily service tokens (kfxs_…) are machine credentials owned by a project. They call the data API (/api/p/:projectId/*) and POST /auth/verify. They cannot call console APIs (/api/organizations, schema admin, hosting, …).

They bypass end-user access rules, like a platform token on the data API.

Create them in the console (Developers / service tokens) or with the admin SDK. The secret is returned once.

When to use them

• Password reset, webhooks, and other server routes that read or write collections
• Verifying a project JWT your frontend sent you
• Scripts that must not use a human PAT

Do not put kfxs_… in Expo public env, Vite VITE_* that ships to the browser, or a mobile binary.

Dart

final backend = KataflaxClient(
  baseUrl: 'https://api.tefily.com',
  projectId: 'YOUR_PROJECT_ID',
  serviceToken: Platform.environment['TEFILY_SERVICE_TOKEN']!,
);

final checked = await backend.auth.verify(incomingUserJwt);
if (!checked.valid) {
  throw Unauthorized();
}

await backend.collection('password_resets').create({
  'email': email,
  'tokenHash': hash,
});

REST verify

POST /api/p/{projectId}/auth/verify
Authorization: Bearer kfxs_…
Content-Type: application/json

{"token":"<project user jwt>"}

Response: { "success": true, "data": { "valid": true, "user": { ... } } } (shape may wrap valid / user in data).

See the backend guide.