Authentication

Scoped endpoints use Bearer tokens. The token is issued only after the user approves a pairing request inside SuperAge.

curl --request GET \
  --url "<LAN_API_URL>/api/v1/metrics" \
  --header "Authorization: Bearer <TOKEN>"

Scopes

The v1 API uses these scopes:

Scope	Description
`superage.metrics`	SuperAge metric summaries.
`superage.workouts`	Workout summaries.
`superage.nutrition`	Nutrition logs and foods.
`superage.bloodTests`	Blood test summaries.
`healthkit.raw`	Raw HealthKit type and sample reads.

Errors

Missing or insufficient scope returns 403 with:

{
  "apiVersion": "v1",
  "requestId": "req_00000000-0000-0000-0000-000000000000",
  "error": {
    "code": "not_authorized",
    "message": "Missing scope."
  }
}

The v1 data API is read-only. Unsupported methods return 405 and include:

Allow: GET, HEAD, OPTIONS