Authentication

NapX PMS uses BetterAuth for authentication, configured with the adapter pattern so the underlying provider can be swapped (e.g. Auth0, AWS Cognito).

How it works

1. The client sends a POST /v1/auth/sign-in request with email and password.
2. The BetterAuthAdapter validates credentials and returns a session token.
3. Subsequent requests include the token in the Authorization: Bearer <token> header.
4. The AuthGuard on each controller validates the session on every request.
5. The TenantGuard reads the x-tenant-id header and sets the PostgreSQL RLS context for the request.

Endpoints

Method	Path	Description
POST	/v1/auth/sign-in	Sign in with email/password
POST	/v1/auth/sign-up	Register a new user
POST	/v1/auth/sign-out	Revoke the current session

See the API Reference for full request/response schemas.

Headers

Every authenticated request must include:

Authorization: Bearer <session-token>
x-tenant-id: <tenant-id>

External API keys

The /v1/external/* routes use a different auth model for third-party integrations:

• Send Authorization: Bearer <napx_live_...> or X-Api-Key: <napx_live_...>.
• Do not send x-tenant-id; tenant and property context are derived from the API key.
• The key must be property-scoped.

See External Integrations for the external route catalogue and scope rules.