[functions.username-lookup]
# The function authenticates a narrow, independent server-to-server token itself.
verify_jwt = false

[functions.sandbox-registration]
# Temporary create-only registration, protected by an expiring server-only secret.
verify_jwt = false

[functions.send-sms-melipayamak]
# Only signed Supabase Auth webhooks may send SMS; verified inside the handler.
verify_jwt = false

[functions.send-sms-kavenegar]
# Only signed Supabase Auth webhooks may send SMS; verified inside the handler.
verify_jwt = false

[functions.wallet-link]
# Supabase Auth verifies every bearer token inside the function; no anonymous writes.
verify_jwt = false

[functions.bale-payments]
# User actions verify Supabase JWTs; Bale callbacks authenticate a private webhook path.
verify_jwt = false

[functions.usdt-payments]
# Every user/admin token is verified inside the handler; service-key requests only reconcile pending deposits.
verify_jwt = false