service · inferred from evidence
Management API
An API used by the Supabase CLI for authentication and project management.
- Grant type not allowed: enable the grant on the application first
Auth0 rejects token requests with grant types the application is not allowed to use. The fix is in the dashboard's grant settings, not in the request code.
- Token has the wrong audience: API identifier vs Management API audience
An access token minted for one audience is rejected by another API. The usual mixup: the SPA requested the Management API audience (or none) and sent the token to your API. Not for different error messages.
- Hitting rate limits: which endpoint, headers, and log events to read
Symptom: intermittent 429s. Cause: one hot endpoint or one misbehaving client. Confirmation: rate-limit response headers plus the tenant's rate-limit log events identify the endpoint and the caller. Not the full reference manual.
- Tenant config as code: auth0-deploy-cli and the Terraform provider
Click-ops tenants drift. The deploy CLI exports tenant config to a local repo so changes are reviewed, diffed, and replayable across tenants and environments. Not the full reference manual.
- M2M scopes end to end: register API, add permissions, authorize app, request scopes
Scopes fail when any of the four steps is skipped: define the permission on the API, grant it to the app, request it in the token call, enforce it in the API. Debug by walking the chain in order. Not the full reference manual.