sherlock
shebang's identity provider — one account for the dashboard, the API, and every app you build on it.
sherlock
sherlock is shebang's own identity provider, built on Supabase Auth. It does two separate jobs:
- It's the account you sign in with at
dash.shebang.pro— the identity behind your API keys, projects, and everything else in these docs. - It's also an OAuth 2.1 / OIDC provider your own apps can use, so an end user can sign in with sherlock the same way they'd sign in with Google or GitHub elsewhere — and your app never has to build its own password form.
Both jobs share one instance, reachable at auth.shebang.pro, and one
discovery document:
https://auth.shebang.pro/auth/v1/.well-known/openid-configuration
That document advertises the endpoints, supported scopes
(openid profile email phone), and PKCE — S256 only, no plain
challenge — every client below relies on.
In this section
- Sign-in methods — password, one-time email code, Google, GitHub, and two-factor.
- Sign in with sherlock (redirect) — the OAuth 2.1 flow for letting another app authenticate against your sherlock account.
- Account management — the dashboard's account page: connected apps, sign-in methods, keys, sessions.
- Handles — the
@handleevery account has, and what it's used for today.
sherlock also issues the tokens your own end users sign in with, if you're building an app on top of a shebang-hosted database — see sherbase for how row-level security reads those tokens.