👤 Browser
Supabase JWT
🎤 Pi (sudoedge)
Device JWT (HS256, 1y)
sudo-api
verifies Supabase + Device JWT
voice-bridge
internal bearer to sudo-api
livekit-server
scoped LiveKit tokens
hermes (per-user)
API_SERVER_KEY =
HMAC(JWT_SECRET, user_id)
Supabase Auth
issues + verifies JWTs
Bearer Supabase JWT
Bearer Device JWT
LiveKit token (room-scoped)
agent LiveKit token
API_SERVER_KEY
API_SERVER_KEY
asyncpg
The three API trust zones inside sudo-api
/v1/me/* · Supabase JWT
things a logged-in user does
/v1/internal/* · PROVISIONER_INTERNAL_TOKEN
service-to-service only · Caddy blocks the public path
/v1/admin/* · Supabase JWT + ADMIN_EMAILS
allowlisted admin operations