Authentication
upLegal uses Supabase authentication for user management. Authentication is required for most endpoints and is handled through session tokens.Authentication Methods
Email/Password Login
Standard email and password authentication.Magic Link Login
Passwordless authentication via email magic link.Session Management
Get Current Session
Retrieve the current user session.Current session object
JWT access token for API requests
Token for refreshing the session
Session expiration timestamp
Refresh Session
Refresh an expired session using the refresh token.Sign Out
End the current user session.User Roles
upLegal supports two user roles:- client: Standard users seeking legal services
- lawyer: Legal professionals offering services
user_metadata.role and synchronized to the profiles table.
Protected Routes
Most API endpoints require authentication. Include the session token in your requests:Error Responses
Common Authentication Errors
| Status Code | Error Message | Description |
|---|---|---|
| 401 | Invalid login credentials | Wrong email or password |
| 401 | Email not confirmed | User hasn’t verified their email |
| 403 | Unauthorized | Missing or invalid access token |
| 429 | Too many requests | Rate limit exceeded |
Security Notes
- Sessions expire after 1 hour of inactivity
- Refresh tokens are valid for 30 days
- All authentication endpoints use HTTPS only
- Row Level Security (RLS) policies enforce data access control