Authentication & General Conventions

Base URL, Bearer JWT auth, x-organization-id header, pagination, and response envelopes.

Authentication#

Docklify APIs use the user’s Supabase session. In a browser the session cookie is enough; for integrations pass the user’s Supabase JWT as Authorization: Bearer <jwt> (supported since 2026-10-08, used by the mobile proxy). Unauthenticated requests return 401.

BASE="https://saas.docklify.com/api"
TOKEN="<supabase-access-jwt>"
ORG="<organization-id>"

curl -s "$BASE/wms/inventory?page=1&page_size=20" \
  -H "Authorization: Bearer $TOKEN" \
  -H "x-organization-id: $ORG" | jq .

Organization scope#

Nearly every endpoint is tenant-scoped. Pass the organization with the x-organization-id header (preferred) or the organization_id query parameter. A non-member gets 403; missing organization gets 400 (WMS_VALID_001).

Pagination#

List endpoints accept page and page_size (default 20, max 100; the print queue allows up to 200). Responses carry meta: { total, page, page_size }.

Response envelopes#

Success returns { ok: true, data, meta? }. WMS errors return { code, message, details? } with a semantic HTTP status (see the Error Codes article). Branch on code, never on message text.

// success (HTTP 200)
{ "ok": true, "data": { "id": "…" }, "meta": { "total": 128, "page": 1, "page_size": 20 } }

// error (e.g. HTTP 409)
{ "code": "WMS_STOCK_001", "message": "库存可用量不足", "details": { "item_id": "…" } }