Last1 ID Deployment

C0 quarantine 2026-09-13. Hosted project nztgswcpnwggymncrnyx is deleted (NXDOMAIN). Railway last1.id was torn down. Do not supabase link hosted. Do not deploy this service to Railway.

Live (sovereign)

• Issuer / API: https://auth.last1.id
• Store: last1id-db on R940 (BWS project last1id)
• Apply migrations against last1id-db. Never hosted *.supabase.co.

HISTORICAL (deleted — do not restore)

The following were the pre-sovereignty pointers. They are dead:

• Hosted URL: https://nztgswcpnwggymncrnyx.supabase.co
• supabase link --project-ref nztgswcpnwggymncrnyx
• Railway SUPABASE_URL / SUPABASE_SERVICE_ROLE_KEY for that project

Security (still current)

CSRF protection

• Auth/login against the sovereign GoTrue on auth.last1.id.
• API uses Bearer tokens in the Authorization header (not cookies).
• Origin validation: state-changing API requests with an Origin header are rejected unless the origin matches SITE_URL. Set SITE_URL=https://last1.id.

Rate limiting

Auth-related API endpoints are rate-limited per IP:

• General API (/api/*): 200 requests per 15 minutes
• Auth flow (/api/identity/me, /api/identity/onboarding): 30 requests per 15 minutes
• Verification (Turnstile, phone SMS): 10 requests per 15 minutes