Authentication
Supabase Auth with httpOnly session cookies. Production requires HTTPS on the app URL.
Security
Access control for a multi-supplier workspace
Ticketing Experts uses Supabase Auth, membership roles, tenant-scoped queries, optional Postgres RLS, hashed partner API keys, and signed QR tickets. We do not claim SOC 2, ISO 27001, PCI DSS, or HIPAA.
Security
Controls that exist in the product today
We describe authentication, roles, isolation, and ticket signing as implemented. We do not claim SOC 2, ISO 27001, PCI, or HIPAA certifications.
Authorization
Membership roles gate navigation and server actions. Gate staff can be limited to devices and the scanner.
Tenant isolation
Queries are scoped by tenant (and usually supplier). Postgres RLS policies add a second layer on tenant-owned tables.
Ticket integrity
QR payloads are HS256 JWTs signed with a server secret. Devices can verify authenticity offline.
Public API hygiene
Optional Upstash rate limits on checkout and voucher routes. CORS and embed origin allowlists.
Partner credentials
Reseller and channel API keys are stored hashed. Invites expire after seven days.
Fill the room from one workspace
Every seat sold
Start with Ticketing Experts. Catalog, bookings, payments, POS, and the gate stay together.