I am trying to create an onboarding UI flow. This UI could take the form of an embedded UI (similar to Stripe Elements) or a “popup flow” hosted on my own domain (similar to the Klarna onboarding flow), whichever is easier to get started 🙂

This UI will be used to onboard customers for my merchant users. So my merchant would embed or link my UI from their own portal. When their customers go to the merchant’s portal, they would use my UI to input various onboarding information.

I need to make sure that calls to this UI are somehow authenticated so that I know that (a) which merchant user is making the request and (b) so I can save the customers to the right merchant. These merchant users already have API keys, but my understanding is that I shouldn’t use those to authenticate client requests since it’s not secure and those API keys should be kept secret.

My database is Supabase, but I’m not sure Supabase auth is the right fit here bc merchants won’t be “signing in” to onboard customers; rather, they are hosting my UI so that customers can onboard themselves.

What is the right way to authenticate a flow like this? Do I need some sort of publishable key and if so, what is the right handoff to the server to not leak secrets? Are there any frameworks that handle something like this to get started quickly?

Thanks in advance!