Blood Connect’s primary application API is tRPC at /api/trpc. Selected REST routes cover auth, health, mobile, USSD/IVR, and privacy workflows.
Production base: https://www.bloodlinks.org
The platform uses a dual auth model: Supabase sessions (primary) and Spring Boot JWT (secondary / mobile). Web clients typically obtain a Bearer token via flexible sign-in or Supabase session helpers.
POST /api/auth/flexible-signinPOST /api/auth/flexible-signup or /api/auth/registerPOST /api/auth/refresh/api/auth/oauth/*Authenticated tRPC procedures expect: Authorization: Bearer <token>
POST /api/trpc/{router}.{procedure}?batch=1
Content-Type: application/json
Authorization: Bearer <access_token>
{ "0": { "json": { /* input */ } } }In the Next.js app, prefer the typed tRPC client (`@/lib/trpc/client`) rather than raw fetch.
Source of truth: src/lib/trpc/root.ts and src/lib/trpc/routers/
/api/auth/flexible-signinPrimary email/password sign-in/api/auth/flexible-signupAccount registration/api/auth/refreshRefresh access token/api/auth/logoutEnd session/api/auth/statusAuth status check/api/auth/mfaMulti-factor authentication/api/healthService health check (public)/api/feature-gatesFeature gate state (public)/api/trpc/[trpc]tRPC batch endpointAdditional REST surfaces exist under /api/mobile/*, /api/ussd, /api/ivr, /api/privacy/*, and /api/emergency/*.
// Sign in (REST)
const signIn = await fetch('https://www.bloodlinks.org/api/auth/flexible-signin', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
email: 'donor@example.com',
password: 'your-password'
})
});
const { accessToken } = await signIn.json();
// Call a tRPC procedure (batch style)
const response = await fetch(
'https://www.bloodlinks.org/api/trpc/users.getProfile?batch=1',
{
method: 'POST',
headers: {
'Content-Type': 'application/json',
Authorization: `Bearer ${accessToken}`
},
body: JSON.stringify({ 0: { json: {} } })
}
);
const data = await response.json();API and auth routes are protected with Upstash Redis rate limiting where enabled. Limits vary by endpoint; treat production traffic as subject to throttling and retry with backoff.
Related tRPC: rateLimitingSecurity