Skip to main content

​
Authentication

PILLAR uses Supabase Auth for authentication with Row-Level Security (RLS) enforcing multi-tenant data isolation.

​
Auth Flow

  1. User authenticates via Supabase Auth (email/password or SSO)
  2. Supabase issues a JWT token linked to auth.users
  3. The users table links auth_user_id to the PILLAR user record
  4. RLS policies filter all queries by org_id

​
User Roles

RoleAccess Level
LeaderFull org access, all dashboards and settings
ManagerTeam-level access, pipeline and forecast views
Rep_CSMOwn accounts, opportunities, and renewals
AdminFull access plus configuration and user management
Executive_RORead-only access to all dashboards

​
API Authentication

All API routes require a valid Supabase session. The session is validated via: 
GET /api/auth/me
Returns the current user profile including org_id, role, and user_id.

​
Row-Level Security

All database tables enforce RLS policies scoped to org_id. Users can only access data belonging to their organization. Rep_CSM users are further scoped to their owned accounts.