Authentication & API Keys

Overview

Euriqa supports two authentication methods. Both enforce the same authorization rules, including row-level security and role-based access control.

API Keys

API keys are the recommended way to authenticate CI/CD pipelines and programmatic access to the Euriqa platform. Each key is scoped to a specific project for isolation.

Key Format

API keys must be a minimum of 16 characters. Euriqa validates key format on every request and rejects placeholder values such as your-api-key or test-key.

Key Scoping

Every API key is scoped to a single project. This means a key can only access data belonging to the project it was generated for. Keys cannot access data from other projects or teams.

Creating API Keys

Via the Dashboard: Navigate to your project settings at app.euriqa.dev and click "Generate API Key". Give each key a descriptive name (e.g., "GitHub Actions", "GitLab CI", "Local Dev").

Via the API:

curl -X POST https://app.euriqa.dev/api/api-keys \
  -H "Content-Type: application/json" \
  -H "Cookie: <session-cookie>" \
  -d '{
    "name": "GitHub Actions",
    "projectId": "your-project-id",
    "expiresAt": "2026-12-31T00:00:00Z"
  }'

Managing Keys

API keys can be activated or deactivated without deleting them. This is useful for temporarily disabling access without losing the key configuration. You can also set optional expiration dates for added security.

Key Properties

Using API Keys

Include your API key in the X-API-Key header with every request:

curl https://app.euriqa.dev/api/runs \
  -H "X-API-Key: your-api-key"

For the Playwright reporter, set the key as an environment variable:

export EURIQA_API_KEY=your-api-key
export EURIQA_PROJECT_ID=your-project-id
npx playwright test

Key Validation

The reporter SDK validates API keys before making any network calls. Validation checks include:

• Minimum 16 characters
• Rejects known placeholder values
• Verifies the key is active and not expired
• Confirms the key is scoped to the provided project ID

User Authentication

User authentication is handled via Supabase Auth with email/password credentials. Sessions are managed automatically in the browser.

Sign Up

Create an account at app.euriqa.dev/signup. Email verification is mandatory before you can access the platform. After verifying your email, the onboarding wizard will guide you through creating your first team and project.

POST https://app.euriqa.dev/auth/signup
Content-Type: application/json

{
  "email": "you@company.com",
  "password": "your-secure-password"
}

Login

Sign in with your email and password. A session cookie is set automatically for subsequent requests.

POST https://app.euriqa.dev/auth/login
Content-Type: application/json

{
  "email": "you@company.com",
  "password": "your-secure-password"
}

Forgot Password

Request a password reset email. A secure reset link will be sent to the email address on file.

POST https://app.euriqa.dev/auth/forgot-password
Content-Type: application/json

{
  "email": "you@company.com"
}

Team Roles & Permissions

Every team member is assigned a role that determines what actions they can perform. Roles are enforced at both the API and database levels.

Row-Level Security

All data access in Euriqa is controlled at the database level using Supabase Row-Level Security (RLS). This means authorization is enforced regardless of how the data is accessed — through the dashboard, API, or direct database queries.

• User-scoped: Users can only access their own account data.
• Team-scoped: Users can only access teams they belong to.
• Project-scoped: Test data is isolated per project.
• Role-based: Actions are gated by team role (Owner, Admin, Member, Viewer).

Security Best Practices

1. Use environment variables — Never hard-code API keys in your source code or configuration files. Store them as CI/CD secrets or environment variables.
2. Rotate keys regularly — Create new keys and deactivate old ones on a regular schedule. Euriqa lets you have multiple active keys per project to enable zero-downtime rotation.
3. Set expiration dates — Use the optional expiration field when creating keys to ensure they cannot be used indefinitely.
4. Use descriptive key names— Name keys after their purpose (e.g., "GitHub Actions Production") so you can quickly identify and revoke compromised keys.
5. Use the principle of least privilege — Assign the Viewer role to team members who only need read access to test results.
6. Monitor key usage— Regularly review the "last used" timestamps on your API keys to identify unused or potentially compromised keys.
7. HTTPS only — All API communication uses HTTPS. Never send API keys over unencrypted connections. The only exception is localhost for local development.