Auth, security & SSO
Row Level Security on every table, SAML and OIDC single sign-on, session control and activity logs, on Tenon Cloud or infrastructure you run.
Explore
Extend it, automate it, verify it.
Extend it, automate it, and prove it works.
A public REST API you manage from Developer Settings, webhooks signed with HMAC-SHA256 that retry with exponential backoff, org-defined custom fields, and edge functions that verify your email and tenant-isolation setup. Built on Supabase, so you can also just open the database.
# GET /v1/users: API-key authenticated
curl https://your-tenon.example.com/functions/v1/api-v1/v1/users \
-H "Authorization: Bearer tn_live_…"
# Webhook payload (HMAC-SHA256 signed)
{
"event": "member.added",
"delivery_id": "dlv_01J9…",
"attempt": 1,
"data": { "org_id": "…", "user_id": "…", "role": "member" }
}
X-Tenon-Signature: sha256=3f1a…
Why it matters
The best integration is the one you don't have to fight for.
An all-in-one tool is only trustworthy if it isn't a trap. You should be able to get data out, push events in, and verify the thing is configured correctly, without a "contact sales" button in the way.
Tenon exposes a public REST API (the api-v1 edge function) authenticated by API keys you create and revoke in Developer Settings. Today it covers identity and users; it grows with each release. Webhooks let you subscribe an endpoint to lifecycle events (user.created, user.updated, user.deleted, member.added, member.removed) with HMAC-SHA256 signatures, automatic retries with exponential backoff, and a delivery log showing every attempt and sample payloads.
And because Tenon runs on Supabase, the ultimate API is Postgres itself. Your data is in tables you can query, back up, replicate and connect to any BI tool. Row Level Security still applies to every connection that uses Supabase's roles.
What you get
Developers, item by item.
Public REST API
API-key authenticated endpoints (currently GET /v1/me and GET /v1/users), managed from Developer Settings.
Signed webhooks
Subscribe endpoints to user.created, user.updated, user.deleted, member.added and member.removed. HMAC-SHA256 signatures, exponential-backoff retries, a delivery log with sample payloads.
Custom fields manager
Org admins define fields for tickets and pages without a migration.
Test-email function
Verify your SMTP or email provider from inside the app.
RLS self-test
An edge function that proves tenant isolation is working on your deployment.
Webhook lifecycle
Signed, retried, logged.
Register an endpoint
Paste a URL, choose the events you care about, and get a signing secret.
Verify the signature
Every delivery carries an X-Tenon-Signature header: HMAC-SHA256 of the body with your secret. Reject anything that doesn't match.
Watch the log
Every attempt, status code and response is recorded. Failed deliveries retry automatically with exponential backoff.
Events available today
- user.created
- user.updated
- user.deleted
- member.added
- member.removed
Ticket, page and project events are on the roadmap. Tell us which you need first.
Deployment self-tests
Know it's right before anyone logs in.
Two edge functions ship for exactly this purpose.
- test-emailSends a message through your configured provider and reports what happened, so invitations don't silently fail.
- rls-self-testAttempts cross-tenant reads and writes and confirms each one is denied. Attach the output to your audit evidence.
Custom fields
Schema changes without migrations.
Org admins define custom fields for tickets and pages from the Custom Fields Manager. Text, number, select, date: they appear across the organization immediately and are searchable.
A Tuesday afternoon with Tenon
Wiring Tenon into the HR system in an afternoon.
Nadia's task: when someone joins the company, they should be in Tenon; when they leave, they should be out. She creates an API key in Developer Settings and points the onboarding script at GET /v1/users to reconcile. Then she registers a webhook for member.removed so the HR system is told when an admin removes someone.
She tests the signature check with a sample payload from the delivery log, breaks it on purpose, watches it retry with backoff, fixes it, and ships. Total time: under three hours, no support ticket.
Nadia, platform engineer, 400-person company
Questions
Common questions.
What endpoints does the API have today?
GET /v1/me and GET /v1/users (list and get). The API is versioned and grows with each release; ticket and page endpoints are next.
How are API keys managed?
From Developer Settings in the app. Create, name, rotate and revoke keys per organization. Keys are shown once and stored hashed.
How do I verify a webhook?
Compute HMAC-SHA256 of the raw request body with your endpoint's signing secret and compare it to the X-Tenon-Signature header using a constant-time comparison.
What happens when my endpoint is down?
Tenon retries with exponential backoff and records every attempt in the delivery log, including the response code and body.
Can I query the database directly?
Yes. It is your Postgres. Use Supabase's client libraries with a user session (RLS applies), or connect a BI tool with a read-only role you control.
Fits together with
The rest of the joint.
Projects & work tracking
Kanban boards, timelines, hill charts and analytics, so every project has one honest picture of where it stands.
ExploreBrain, the AI assistant
A floating assistant that knows your projects and tickets, drafts work for you, writes the morning briefing, and runs on the AI provider you choose.
ExploreBring every piece of work into one place.
Start free on Tenon Cloud in two minutes, no credit card. Or host it yourself for your departments and clients.